T09 · Insecure Skill Coding Practices
Error
- Location
jq_config.py:8- Finding
Enabled plaintext JQData credentials are embedded and automatically transmitted
- Content
View full analysis
- Remediation
View remediation
Security audit
Hs300 Research V5
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Chinese stock-research tool, but it ships plaintext financial-data service credentials and enables authenticated provider access in ways the documentation says are disabled or user-configured.
Review before installing or running. The embedded JQData password and Tushare token should be removed and rotated, authentication should use user-supplied environment secrets, JQData documentation should match implementation, and pickle caches should be replaced with a safer format before use in a shared or sensitive environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
tushare_config.py:8- Finding
Enabled plaintext Tushare API token is distributed in source code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
data_fetcher.py:174- Finding
Executable pickle caches allow local arbitrary code execution
- Content
View full analysis
timedelta(hours=expire): return None try: with open(path, 'rb') as f: return pickle.load(f) except Exception: return None ``` The cache is enabled and placed inside the project tree: ```python # config.py:91-95 CACHE_CONFIG = { 'enable': True, 'expire_hours': 24, 'path': os.path.join(DATA_DIR, 'cache') } ``` ### Technical Analysis Python pickle is an executable serialization format. During `pickle.load`, attacker-controlled reduction methods can import modules and invoke arbitrary callables. Catching exceptions does not provide protection because a malicious callable may execute before deserialization returns or raises an error. The project does not authenticate cache contents, restrict ownership, or use a non-executable schema. The audit did not find code that downloads pickle files from the network, so exploitation requires the ability to create or replace a cache file locally, through a shared workspace, a malicious archive, a compromised previous task, or another process running under a suitable account. The modification time check is not a security boundary. An attacker can create a fresh file or update its timestamp. ### Attack Path 1. The attacker identifies a predictable cache filename, such as one generated from a stock code o ...[truncated 1029 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:4- Finding
Unpinned third-party dependencies create mutable supply-chain exposure
- Content
View full analysis
=1.8.0 tushare>=1.2.89 pywencai>=0.13.0 # Data processing pandas>=1.3.0 numpy>=1.21.0 # Technical analysis ta-lib>=0.4.24 # Scientific computing scipy>=1.7.0 # Visualization matplotlib>=3.4.0 # Excel processing openpyxl>=3.0.0 # Scheduling schedule>=1.1.0 ``` The Skill also recommends an unconstrained installation command: ```bash pip install akshare tushare pywencai pandas numpy scipy ``` ### Technical Analysis Every version constraint in `requirements.txt` is a lower bound. Installation can therefore select any future release satisfying the constraint. The command in `SKILL.md` is even less restrictive and always resolves packages according to the current package index and environment. Python packages can execute code during installation and arbitrary code when imported. If an eligible upstream release or the configured package index is compromised, users can receive code that was never included in or reviewed with this Skill. The package names observed are consistent with the declared financial-analysis functionality, and the audit did not identify a confirmed typosquatting or dependency-confusion package. The issue is the absence of reproducible, integrity-checked dependency resolution. ### Attack Path 1. A user follows `SKILL.md` or installs `requirements.txt`. 2. pip queries the configured package index and selects the newest compatible versions. 3. An upstream package account, release artifact, dependency, or package-index path has been compromised. 4. pip downloads and installs the malicious but version-compatible artifact. 5. Installation hooks or later imports execute the package code with the user's privileges. 6. The malicious dependency can access the emb ...[truncated 531 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (66)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic Tushare authentication/configuration is broader than the stated HS300-specific functionality and normalizes embedding credential-handling within the skill. This is risky because it encourages secret placement in code-adjacent content and obscures the extent of third-party data access.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Allowing 'arbitrary natural-language questions' through pywencai creates an effectively unbounded trigger and query surface. In this context that is especially dangerous because user prompts may be transmitted to a third party and used for activities far outside the declared HS300 research scope.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script contains hard-coded JQData credentials and immediately authenticates with them. Embedded secrets are dangerous because anyone with access to the file can reuse the account, extract data under the owner's identity, incur cost or quota abuse, and potentially pivot into other systems if credentials are reused.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Using hard-coded JQData credentials without disclosure or safe handling exposes sensitive account material directly in code. This creates immediate credential leakage risk for developers, users, repositories, logs, and downstream packaging, and the HS300 research context does not justify embedding live secrets in a distributed skill.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation claims JQData is disabled, but the code still authenticates and uses it for multiple data paths. This mismatch is dangerous because reviewers, operators, or calling agents may rely on the documented behavior and unknowingly permit external authentication, secret use, and outbound data access that they intended to forbid.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds a live JQData username and password directly in source code via jq.auth(...). Hard-coded credentials are a real secret exposure risk: anyone with access to the skill can reuse the account, consume paid quota, access associated data/services, or pivot into other environments if the password is reused elsewhere. In a research skill, this is not necessary to expose to downstream users and materially increases risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This finding is also valid because the code performs authentication with hard-coded credentials and gives no warning, consent flow, or disclosure to the user that a third-party account is being used on their behalf. That creates both a security issue and a trust/compliance issue: users may unknowingly trigger actions under someone else's account, and exposed credentials can be abused by any reader of the code.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The file contains hardcoded username and password credentials in plaintext. Anyone with repository, package, log, or artifact access can recover and misuse them to access the JQData account, potentially leading to data misuse, account takeover, billing exposure, or lateral compromise if the password is reused elsewhere.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest says this skill is for researching HS300 index constituents and large-cap CSI 300 equities, but the file is explicitly an SZSE data source module and implements generic SZSE A-share, index, and announcement retrieval. This is broader and semantically different from an HS300-focused research skill because it operates at exchange scope rather than restricting itself to CSI 300 constituents.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill documents networked data collection and local file outputs/cache behavior, but it declares no explicit tool scope or permission boundaries. In an agent environment, undeclared network and write capabilities increase the chance of unintended data exfiltration, uncontrolled external requests, or filesystem side effects without user awareness.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation guidance is so broad that it could activate on many ordinary stock-analysis requests, not just HS300-specific tasks. Overbroad triggers are dangerous in agent systems because they increase accidental invocation of a networked, externally querying skill outside its intended scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill relies on multiple third-party data providers, but the documentation does not clearly warn that user queries and research requests may be transmitted externally. This lack of transparency is dangerous because users may unknowingly disclose proprietary strategies, watchlists, or sensitive research interests to outside services.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
JQData（已禁用�?编辑
jq_config.py�?```pythonJQ_USER = '手机�? JQ_PASSWORD = '密码' JQ_AUTH = False # 免费版数据截�?026-02-10，已禁用
text ### Tushare Pro（可选）
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains user-facing natural-language descriptions entirely in Chinese, including the module docstring and later printed status/test messages, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific; this file does not state such a justification.
- Content
Insecure deserialization: pickle.load()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The module deserializes cache files with pickle.load(), which executes attacker-controlled Python opcodes during loading. If an attacker can write or replace files in the cache directory, merely reading cached data can trigger arbitrary code execution; because this skill fetches remote data and may run in shared agent environments, trusting local cache contents is unsafe.
- Content
python return None try: with open(path, 'rb') as f: return pickle.load(f) except Exception: return None