Update Stock Mcp

• Outcome: Review
• Latest audit: Jul 10, 2026 · 5:14 PM UTC
• Version: 2.2.0

Overview

This stock-data skill is mostly purpose-aligned, but it can start a separate background QuantAll service and persist local token/config files, so users should review it before installing.

Install only if you are comfortable with a finance-data skill that writes local database/config files, stores your Tushare token in plaintext, contacts Tushare and baostock, and can start a separate QuantAll MCP service on 127.0.0.1:8686. Review the Start_QuantAll behavior carefully and make sure you know how to stop the background process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 启动子进程（忽略 I/O）
        if sys.platform == "win32":
            process = subprocess.Popen(
                [python_exe, str(target_script)],
                cwd=str(current_dir),
                creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,

• Confidence: 96% confidence
• Finding: This subprocess launch is a real security concern because the skill can start an additional local service outside its declared stock-update scope, using a script written into the skill directory and detached from the parent process. Even though the command arguments are not shell-interpolated, spawning a long-lived local service increases attack surface, can bypass user expectations, and may execute attacker-controlled code if the local QuantAll package or generated Start_QuantAll.py is tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stdin=subprocess.DEVNULL
            )
        else:
            process = subprocess.Popen(
                [python_exe, str(target_script)],
                cwd=str(current_dir),
                stdout=subprocess.DEVNULL,

• Confidence: 96% confidence
• Finding: This non-Windows subprocess path has the same issue: it silently starts a detached child process that exposes another MCP service on localhost. Detached background execution with suppressed I/O makes the action harder to audit and easier to abuse for persistence or to mask unexpected service behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities to read and write local files and invoke a Python process, yet no explicit permissions are declared. This weakens user visibility and policy enforcement around filesystem and process-launch behavior, making it easier for the skill to perform sensitive actions without clear consent boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose focuses on stock database management, but the skill also launches an external HTTP MCP service, probes localhost ports, generates helper scripts, and modifies configuration files. This broader behavior increases attack surface and can surprise users or bypass expectations about what the skill is allowed to do.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Starting a separate HTTP MCP service via subprocess goes beyond passive data management and introduces a new executable component listening on localhost. Even when intended for integration, this creates additional execution and exposure risks if the spawned service or generated launcher script is tampered with or misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill includes functionality to launch and manage a separate QuantAll MCP service, which exceeds the stated purpose of stock database creation, update, and query. Scope expansion is dangerous in agent skills because users and orchestrators may grant trust based on the manifest description while the code performs broader system actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code both spawns a subprocess and manages a network-reachable local HTTP/MCP service, which materially increases system exposure beyond simple data maintenance. In skill contexts, opening or assuming control of localhost services can enable privilege pivoting, confused-deputy behavior, and unintended interaction with other local tools or ports.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill rewrites DB_setting.json to control another tool/service's persistent database path and load window. Persistent cross-tool configuration changes are risky because they alter future behavior outside the immediate invocation and can redirect data access to unintended files or disrupt other components that trust that config.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Open-ended trigger language such as '等' makes activation criteria ambiguous, which can cause the skill to run in contexts broader than users expect. For a skill with file, subprocess, and configuration-writing behavior, overbroad invocation increases the chance of unintended sensitive actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to store a tushare API token in a plaintext local file without prominent security warnings or safer alternatives. Plaintext credential storage increases the risk of accidental disclosure through backups, shared directories, malware, or other local tools reading the file.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill creates and reads a local API credential file automatically without clear user-facing disclosure about local secret storage. This is dangerous because credentials may be left in plaintext on disk, reused unexpectedly by future invocations, or exposed to other local users/processes depending on filesystem permissions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The secondary update path repeats the same undisclosed local credential handling behavior, reading API_tushare.txt and creating it if absent. Repeated hidden secret-file use increases the chance that a user or calling agent misunderstands where credentials are stored and how long they persist.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.26.0
pydantic>=2.0.0
pandas>=2.3.3
numpy>=1.24.0

• Confidence: 90% confidence
• Finding: The dependency is specified with a lower-bound only, which allows future unresolved versions to be installed. This weakens build reproducibility and can introduce supply-chain risk if a later incompatible or vulnerable release is pulled during installation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.26.0
pydantic>=2.0.0
pandas>=2.3.3
numpy>=1.24.0
duckdb>=1.5.2

• Confidence: 98% confidence
• Finding: Using pydantic with a lower-bound constraint allows any later 2.x/3.x-compatible resolver outcome, reducing reproducibility and potentially introducing vulnerable releases. In this file, this is more dangerous because the same dependency is also associated with a known vulnerable version range in the static findings, so loose constraints make it easier to install an unsafe build.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.26.0
pydantic>=2.0.0
pandas>=2.3.3
numpy>=1.24.0
duckdb>=1.5.2
tushare>=1.4.29

• Confidence: 90% confidence
• Finding: The pandas dependency is not pinned to an exact version, so installs may vary over time and across environments. This creates avoidable supply-chain and stability risk, especially for a data-processing skill that depends on consistent behavior when handling market data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.26.0
pydantic>=2.0.0
pandas>=2.3.3
numpy>=1.24.0
duckdb>=1.5.2
tushare>=1.4.29
baostock>=0.9.1

• Confidence: 90% confidence
• Finding: The numpy dependency is only minimally constrained, allowing arbitrary newer versions to be resolved. That can introduce breaking changes or newly disclosed vulnerabilities without any code change in the skill itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pydantic>=2.0.0
pandas>=2.3.3
numpy>=1.24.0
duckdb>=1.5.2
tushare>=1.4.29
baostock>=0.9.1

• Confidence: 90% confidence
• Finding: An unpinned duckdb dependency means the installed database engine version may drift over time. For a skill that creates and updates stock databases, inconsistent versions can affect security posture, query behavior, and operational reliability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.3.3
numpy>=1.24.0
duckdb>=1.5.2
tushare>=1.4.29
baostock>=0.9.1

• Confidence: 88% confidence
• Finding: The tushare package is not pinned, so dependency resolution may pull an unreviewed future release. Because this skill interacts with external stock data providers, unpinned third-party client libraries increase supply-chain exposure and reduce auditability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
duckdb>=1.5.2
tushare>=1.4.29
baostock>=0.9.1

• Confidence: 88% confidence
• Finding: The baostock dependency is specified with only a minimum version, which permits unpredictable future versions. This is a supply-chain hygiene issue that can lead to accidental installation of vulnerable or incompatible releases.

Static analysis

No suspicious patterns detected.