PyWenCai Stock

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

This stock-data skill is mostly purpose-aligned, but it includes unsafe troubleshooting and example-code patterns that users should review before installing.

Install only in a dedicated virtual environment, avoid running the example.py file as written, do not use the SSL verification bypass, and prefer pinned reviewed dependency versions. The core search wrapper itself appears aligned with its stated stock-data purpose, but these unsafe examples and troubleshooting steps justify a careful review before use.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-35, SKILL.md:124-126, and README.md:38
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

# SKILL.md:30-35
# 1. Install pywencai
pip install pywencai

# 2. Install pandas if large amounts of data need to be processed
pip install pandas

bash

# SKILL.md:124-126
# Upgrade to the latest version
pip install -U pywencai

text

# README.md:38
Prerequisite: Python 3.8+, `pip install pywencai pandas`

Technical Analysis

The installation instructions retrieve pywencai and pandas without version constraints, package hashes, a lockfile, or repository restrictions. The upgrade instruction explicitly installs the latest package version available at execution time. Consequently, the code reviewed during this audit may not be the same dependency code installed by a user later.

This creates a supply-chain risk if a package account, release process, package index, or dependency is compromised. It also permits unexpected breaking or security-relevant changes to enter the environment without review. The project itself does not demonstrate that either named package is currently malicious; the finding concerns the unsafe dependency acquisition procedure.

Attack Path

1. An attacker compromises a dependency publisher, package release process, package-index account, or transitive dependency.
2. The attacker publishes a malicious package release under a dependency name resolved by pip.
3. A user follows the documented pip install pywencai, pip install pandas, or pip install -U pywencai instruction.
4. pip resolves the mutable malicious release because no reviewed version or hash is required.
5. Malicious installation hooks or imported package code execute with the privileges of the user running pip or the Skill.

Impact Assessment

Successf ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version.
2. Generate and commit a lockfile containing all transitive dependency versions.
3. Record package hashes and install with pip install --require-hashes.
4. Replace the unrestricted upgrade command with a controlled dependency-update process that includes review and testing.
5. Install dependencies inside a dedicated, least-privileged virtual environment.
6. Explicitly configure and document the trusted package index rather than relying on mutable environment defaults.
7. Add automated dependency vulnerability and provenance scanning to the release process.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:128

Finding

Documented Process-Wide TLS Certificate Verification Bypass

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:128-130
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

python

# If an SSL error occurs, try disabling verification (not recommended)
import ssl
ssl._create_default_https_context = ssl._create_unverified_context

Technical Analysis

The troubleshooting guidance replaces Python's default HTTPS context factory with an unverified context. This is a process-wide modification: subsequent Python components that rely on the default SSL context can establish encrypted connections without authenticating the remote server's certificate.

Encryption without certificate verification does not provide reliable endpoint identity. A network-positioned attacker can present an arbitrary certificate and impersonate the intended service. Although the documentation labels the workaround as not recommended, presenting executable instructions still creates a realistic unsafe configuration path.

Attack Path

1. A user encounters a certificate or trust-store error while using the Skill.
2. The user applies the documented override before issuing a pywencai query.
3. The Python process creates later HTTPS connections with certificate verification disabled.
4. An attacker controlling a proxy, wireless network, gateway, DNS path, or another network interception point redirects or intercepts the connection.
5. The attacker presents a forged certificate, which the modified SSL context accepts.
6. The attacker reads, modifies, fabricates, or replays responses exchanged over the affected connection.

Impact Assessment

Exploitation can compromise the confidentiality and integrity of HTTPS traffic originating from the affected Python process. In this project's context, an attacker could manipulate market and financial data returned to the application. If the same process sends cookies, authentication material, or other sensitive ...[truncated 233 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the certificate-verification bypass from the troubleshooting documentation.
2. Diagnose and repair the underlying certificate trust-store problem instead.
3. Use an explicit, trusted CA bundle when a service requires a private or nonstandard certificate authority.
4. Keep hostname and certificate-chain validation enabled for every HTTPS request.
5. If custom TLS configuration is unavoidable, scope it to one explicitly identified client and endpoint rather than modifying Python's global SSL context.
6. Fail closed and report an actionable error when certificate validation fails.
7. Document secure platform-specific trust-store repair procedures.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/example.py:6

Finding

Predictable Shared Temporary Directory Precedes Trusted Modules in Python Import Path

Content

View full analysis

Vulnerability Details

File Location: scripts/example.py:6-9
Vulnerability Type: Python module search-path hijacking
Risk Level: High

Vulnerable Code

python

import sys
sys.path.insert(0, '/tmp/mootdx')  # If the library is installed here

import pywencai

Technical Analysis

The example inserts the predictable /tmp/mootdx directory at index zero of sys.path before importing pywencai. Python searches this path before normal environment and site-package directories. A file named pywencai.py or a package named pywencai placed in that directory will therefore replace the intended dependency.

Shared temporary locations are generally unsuitable as trusted module roots because other local users or processes may be able to create or modify their contents. The code does not verify directory ownership, permissions, canonical location, module provenance, or package integrity before importing from it.

Attack Path

1. An attacker capable of writing to /tmp creates /tmp/mootdx.
2. The attacker places a malicious /tmp/mootdx/pywencai.py file or /tmp/mootdx/pywencai/__init__.py package in that directory.
3. A victim executes scripts/example.py.
4. The script prepends /tmp/mootdx to sys.path.
5. Python resolves import pywencai from the attacker-controlled directory instead of the legitimate installed package.
6. The malicious module's top-level code executes immediately with the victim process's privileges.
7. The fake module may then imitate expected functions to conceal the compromise while performing additional unauthorized actions.

Impact Assessment

Successful exploitation provides arbitrary Python code execution with the privileges of the user running the example. The attacker can access or modify files available to that user, read environment variables and application secrets, make network connections, alter returned financial data, and execute child processes ...[truncated 213 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove sys.path.insert(0, '/tmp/mootdx').
2. Install the reviewed pywencai dependency in a dedicated virtual environment and import it through the standard package mechanism.
3. Never add a shared or predictable temporary directory ahead of trusted package directories.
4. If a development checkout must be imported, use a project-owned canonical path with restrictive permissions and validate its ownership before use.
5. Pin and verify the imported dependency as described in the dependency-hardening guidance.
6. Run examples and production workloads as a nonprivileged user.
7. Add a test that rejects imports resolving outside the approved virtual environment or project directory.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states "用中文任意搜索" (search freely using Chinese), which imposes a specific language expectation in the skill description. There is no opt-in, alternative language support, or justification that the skill is intentionally limited to a Chinese-only compliance or regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file uses Chinese-only natural-language docstrings, argument descriptions, and exception text such as the installation prompt, which imposes a specific language on users without opt-in. The policy specifically flags language or locale constraints when the skill does not offer a language choice or clearly justify that it is region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in the skill description about behaviors affecting user data or system integrity. The example demonstrates saving output files locally, but the document does not warn that running these commands will create files and may overwrite existing data if the same filenames are used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Policy-violation checks apply to all file types, including markdown. The skill content and examples assume Chinese-only interaction and do not indicate that users may choose another language or that the locale restriction is intentionally region-specific and documented as such.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This is a markdown file, so missing-warning checks apply to descriptions of behaviors that affect user data or system state. The examples explicitly write output files with to_csv and to_excel, but the surrounding documentation does not warn that running them will create local files and may overwrite existing files with the same names.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The only natural-language description in this file is presented exclusively in Chinese, which may imply a fixed language experience without offering a user language choice. Under the policy rule for language or locale constraints, this is a potential violation because no opt-in or justification is provided in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code's natural-language docstrings, comments, query strings, and user-facing print messages are entirely in Chinese. Under the policy for natural-language content, forcing a specific language without user opt-in is a locale/language policy issue unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.