Security audit

A Stock Trading Assistant

Security checks for vulnerabilities and agentic risk

Overview

This A-share trading assistant is coherent, but should be reviewed because it gives actionable trading guidance using market data fetched over unauthenticated HTTP.

Review carefully before installing. Use it only as an informational aid, verify prices and recommendations through a trusted broker or HTTPS market-data source, and be aware that watchlist alerts may persist locally if used.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_stock.py:105
Finding: Unauthenticated HTTP Connections Allow Market Data Manipulation
Content: View full analysis
dict: prefix, clean_code = get_market_prefix(code) symbol = f"{prefix}{clean_code}" url = f"http://hq.sinajs.cn/list={symbol}" raw = fetch_url(url) if raw: data = parse_sina_stock(raw, symbol) if data: return data market = 1 if prefix == "sh" else 0 url2 = ( f"http://push2.eastmoney.com/api/qt/stock/get" f"?secid={market}.{clean_code}" f"&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f107,f169,f170,f171" ) raw2 = fetch_url(url2, {"Referer": "https://www.eastmoney.com"}) ``` ```python def fetch_index() -> list: symbols = "s_sh000001,s_sz399001,s_sz399006,s_sh000688" names_map = { "s_sh000001": "上证指数", "s_sz399001": "深证成指", "s_sz399006": "创业板指", "s_sh000688": "科创50", } url = f"http://hq.sinajs.cn/list={symbols}" raw = fetch_url(url) ``` ```python def fetch_hot_sectors() -> list: url = ( "http://push2.eastmoney.com/api/qt/clist/get" "?pn=1&pz=20&po=1&np=1&ut=bd1d9ddb04089700cf9c27f6f7426281" "&fltt=2&invt=2&fid=f3" "&fs=m:90+t:2+f:!50" "&fields=f2,f3,f4,f12,f14,f20,f128,f136,f207,f208,f209" ) raw = fetch_url(url, {"Referer": "https://www.eastmoney.com"}) ``` The same insecure HTTP endpoints are also documented in `references/data-sources.md:9-14`, `references/data-sources.md:29`, `references/data-sources.md:53-56`, and `references/data-sources.md:59`. ### Technical Analysis Every implemented market-data request uses cleartext HTTP rather than HTTPS. HTTP provides neither transport confidentiality nor server authentici ...[truncated 2341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language description and role definition state that the skill only serves China A-share markets and mixes mandatory Chinese-language stock-query phrasing without presenting this as an optional locale or language mode. Under the policy rule, forcing a specific language/locale context without user opt-in can be a violation unless clearly offered as a choice or justified as an explicit regional compliance tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file gives concrete investment action guidance such as buy/sell signals, position sizing, and sector-tracking advice, but it does not include any financial risk warning, suitability disclaimer, or statement that the material is informational only. In an agent skill context, users may treat these rules as actionable recommendations, increasing the risk of financial harm from overreliance on simplified heuristics.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document uses only Chinese throughout and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific context. Per the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains only Chinese-language instructions and labels, with no indication that users may choose another language or that the Chinese-only format is justified by a region-specific constraint. Under the policy rule for language or locale, this can be considered a forced language choice without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Accept-Language header is fixed to "zh-CN,zh;q=0.9", which imposes a specific locale preference in network requests. The file also presents all user-facing text in Chinese, but does not state that the tool is region-specific or offer any opt-in for language selection.
Content: No source excerpt is available for this finding.