QuantAll

• Outcome: Review
• Latest audit: Aug 10, 2026 · 11:12 AM UTC
• Version: 1.0.4

Overview

This is a disclosed local stock-analysis MCP, but it needs Review because it can start a background local service and exposes broad local Python/task execution with weak technical containment.

Install only if you intentionally want a local quant-analysis MCP that can modify MCP config, install Python packages, store a Tushare API token locally, write stock-analysis databases/results, and run a localhost service. Do not use `execute_python_script` or `run_task_file` with untrusted files, and confirm service startup, database writes, and persistent file creation each time.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 启动子进程（忽略 I/O）
        if sys.platform == "win32":
            process = subprocess.Popen(
                [python_exe, str(target_script)],
                cwd=str(current_dir),
                creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,

• Confidence: 94% confidence
• Finding: This tool launches a new local process from within the skill without any runtime consent gate, and it suppresses stdout/stderr, making the action hard for a user or caller to inspect. In an agent-skill context, spawning background services is security-sensitive because it can change local system state and persist behavior beyond the immediate user request.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stdin=subprocess.DEVNULL
            )
        else:
            process = subprocess.Popen(
                [python_exe, str(target_script)],
                cwd=str(current_dir),
                stdout=subprocess.DEVNULL,

• Confidence: 94% confidence
• Finding: On non-Windows platforms the skill also starts a detached child process with hidden I/O, again without any runtime approval or verification beyond import success. Detached subprocess creation increases risk because the process can keep running independently, exposing a local service and consuming resources without clear visibility or lifecycle control.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to create virtual environments, install packages, modify MCP configuration, start a local HTTP service, and create local files, yet no declared permissions are present. That mismatch undermines platform trust boundaries because a user or host system cannot rely on the manifest to understand or constrain what the skill will do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes materially beyond the advertised purpose of a local quantitative analysis engine: it also manages databases, fetches external market data, reads and writes configuration and credential-adjacent files, and exposes a separate UpdateStock server. This description-behavior gap is dangerous because users and policy systems may approve the skill under a narrower trust model than what it actually enables.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill advertises `execute_python_script` to run local Python scripts and `run_task_file` to execute task definitions from local JSON files, which creates an arbitrary code-execution path on the user's machine. That far exceeds ordinary quant-analysis needs and could be used to run untrusted scripts, alter files, exfiltrate local data, or pivot into broader system compromise depending on the runtime privileges.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill notes that analysis tools can save results to local Excel files, but this local file-output behavior is not clearly represented in the manifest description. Hidden or under-documented file writes reduce informed consent and can surprise users with persistent artifacts, overwritten files, or unintended data exposure on disk.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill's primary purpose is stock-data creation and updates, but it also provisions and starts a separate QuantAll MCP service, including writing a launcher file and exposing localhost:8686. This scope expansion is dangerous in agent environments because a seemingly data-oriented tool gains code-execution and service-management capabilities that a user may not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Including subprocess-based service launch in a data-update skill violates least privilege and increases the blast radius if the tool is invoked by an agent automatically. The danger is amplified because the launch occurs locally on the user's machine, opens a listening service, and is not tightly bound to the minimal task of updating stock data.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The prompt file introduces `save_factor_result`, which persists analysis results into a database, but the skill metadata frames QuantAll primarily as a local quant-computation environment with optional UpdateStock for database management. Expanding capabilities inside prompts beyond the declared scope creates a hidden write surface that can surprise users, weaken consent boundaries, and enable unintended state changes if the agent follows prompt guidance rather than the manifest.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: `execute_python_script` allows execution of an arbitrary local Python file using the QuantAll environment. Even though the prompt says not to use it proactively, this is still a powerful arbitrary-code-execution primitive exposed through the skill, and a malicious or prompt-injected workflow could leverage it to run unreviewed local code, access local files, or perform destructive actions on the user's machine.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: `run_task_file` allows the agent to read a local JSON file and dispatch arbitrary QuantAll tool invocations based on its contents. This creates an indirect orchestration channel from local files into tool execution, which broadens the attack surface beyond interactive quant analysis and could let untrusted local content trigger sensitive operations or bypass normal intent checks.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The tool may create a new launcher file and start a local subprocess with no runtime warning or confirmation, despite the broader skill metadata stating user consent is required for operations on the user's computer. In an autonomous-agent setting, silent file creation plus background execution is a meaningful security issue because it enables unexpected persistence and service exposure.

Static analysis

No suspicious patterns detected.