A股市场数据

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:46 AM UTC
• Version: 1.0.0

Overview

This is a coherent China-market data skill, with the main caution that dependency installation is not pinned and responses are forced into Chinese.

Install and run this in an isolated Python environment, preferably with reviewed pinned versions of `akshare` and dependencies. Expect it to contact AKShare-backed market data sources and to answer in Chinese unless you override that behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/query_akshare.py:394

Finding

Unpinned Runtime Dependency Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/query_akshare.py:394-399; related instruction in SKILL.md:34
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

scripts/query_akshare.py:394-399:

python

def load_akshare_module() -> Any:
    try:
        return importlib.import_module("akshare")
    except ModuleNotFoundError as exc:
        raise SkillError("missing_dependency", "Python package 'akshare' is not installed.", {"install": "python -m pip install akshare --upgrade"}) from exc

Related instruction in SKILL.md:34:

markdown

- Treat missing `akshare` as an environment issue and relay the install command from the error payload.

Technical Analysis

The error payload recommends installing akshare with python -m pip install akshare --upgrade. This command does not constrain the package to a reviewed version and does not verify package hashes. The --upgrade option may also replace an existing, previously reviewed installation with the latest available release.

The project imports both akshare and pandas, but it supplies no version-pinned dependency manifest, lockfile, or hash-verification policy. Consequently, the code executed after installation can vary over time without any modification to this project. A compromised upstream release, malicious transitive dependency, or unexpectedly incompatible update could execute code with the permissions of the user running the installation or invoking the Skill.

The implementation does not itself download and execute a remote script, and no malicious package is proven to exist. The confirmed defect is the unsafe and non-reproducible dependency-installation guidance, which exposes the deployment process to supply-chain compromise.

Attack Path

1. The Skill is executed in an environment where akshare is missing.
2. importlib.import_module("akshare") raises `Mod ...[truncated 1253 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency manifest covering akshare, pandas, and required transitive packages.

2. Pin every dependency to an exact version rather than installing the latest available release.

3. Generate a lockfile and verify package artifacts with cryptographic hashes. For pip-based deployment, use a command such as:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Remove --upgrade from all runtime installation guidance.

5. Install dependencies during a controlled build or deployment phase rather than instructing an Agent or end user to install packages dynamically.

6. Use an isolated virtual environment or container with least-privilege permissions.

7. Review and update pinned versions through a controlled dependency-update process that includes vulnerability scanning and regression testing.

8. Change the missing-dependency response to reference the project's verified installation procedure instead of emitting an unconstrained pip command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description includes broad English phrases like 'market overview', 'stock quote', and 'news flash' alongside generic Chinese market terms, which can cause the skill to activate for loosely related requests. Unintended invocation is risky because it may override a better-suited skill or cause the agent to run external data queries when the user did not explicitly ask for this AKShare-backed capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to 'Reply in Chinese' unconditionally, which can override the user's language preference and reduce transparency or usability for non-Chinese-speaking users. While not directly enabling code execution or data exfiltration, it can degrade safe operation by causing misunderstanding of financial outputs, errors, or ambiguity handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The resolver universe is hard-coded to Chinese index categories such as 沪深重要指数, 上证系列指数, and 中证系列指数, with no indication that users can choose another language or locale. This is a natural-language locale constraint embedded in the skill content and is not explicitly documented as an opt-in or justified region-specific limitation.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/query_akshare.py (reported line 387)May include surrounding context.

python

stderr_buffer = io.StringIO()
    try:
        with contextlib.redirect_stdout(stdout_buffer), contextlib.redirect_stderr(stderr_buffer):
            result = getattr(ak, function_name)(**kwargs)
    except Exception as exc:
        raise SkillError("runtime_error", f"AKShare call failed: {function_name}", {"params": kwargs, "exception": repr(exc)}) from exc
    if not isinstance(result, pd.DataFrame):

Static analysis

No suspicious patterns detected.