T09 · Insecure Skill Coding Practices
Error
- Location
jq_config.py:8- Finding
Hardcoded and Enabled Third-Party Service Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
沪深300多因子投研系统 v6.0 — 多策略量化选股平台
Security checks for vulnerabilities and agentic risk
Overview
This finance research skill is mostly aligned with its stated purpose, but it ships plaintext third-party data-service credentials and has inconsistent disclosure about whether one credentialed service is disabled.
Install only after removing the bundled credentials, rotating any exposed JQData/Tushare secrets, pinning dependencies, and choosing whether to enable scheduled runs. Treat generated rankings and allocation suggestions as research aids, not financial advice, especially where data comes from unauthenticated HTTP or demo/scaffold strategy modules.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
hs300_research_system/scheduler.py:64- Finding
Unpinned Dependencies and Runtime Package Installation
- Content
View full analysis
=1.8.0 tushare>=1.2.89 pywencai>=0.13.0 pandas>=1.3.0 numpy>=1.21.0 ta-lib>=0.4.24 scipy>=1.7.0 scikit-learn>=1.0.0 matplotlib>=3.4.0 openpyxl>=3.0.0 schedule>=1.1.0 ``` The Skill documentation also recommends installing packages without version constraints: ```bash # SKILL.md:148-151 pip install akshare tushare pywencai pandas numpy scipy ``` The scheduler automatically invokes `pip` when an import fails: ```python # hs300_research_system/scheduler.py:64-70 try: import schedule except ImportError: print("Installing schedule library...") subprocess.run( [PYTHON_CMD, '-m', 'pip', 'install', 'schedule'], capture_output=True ) import schedule ``` ### Technical Analysis The requirements use lower-bound constraints rather than exact reviewed versions, and the direct installation command has no version constraints at all. Consequently, installation results can change over time and can include future package versions that were never reviewed with this Skill. The scheduler also mutates the active Python environment during runtime. Python package installation can execute package build and installation logic under the privileges of the current user. If a dependency release or distribution account is compromised, installation can become a code-execution path. No evidence was found that the listed package names are deliberate typosquatting packages or that the project uses an explicitly malicious package index. This finding concerns avoidable supply-chain exposure and non-reproducible dependency management. ### Attack Path 1. A listed package release, maintainer a ...[truncated 1325 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
hs300_research_system/run_analysis.py:40- Finding
Market Data Retrieved over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (232)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad '沪深300多因子投研系统 v6.0' supporting many quantitative strategies, multi-factor stock selection, stock scoring, fundamental/technical analysis, daily research, correlation analysis, performance comparison, and allocation suggestions. The supplied code does not implement any of that broad platform behavior. Instead, it performs one specific task: pre-market call auction analysis for a hardcoded set of 20 stocks using JQData, calculating volume ratio, money ratio, and auction turnover, then printing a textual report. This is materially narrower and different in primary purpose from the declared system. Additionally, the code contains hardcoded JQData credentials and external authenticated data access, while the declared permissions are empty, which is another inconsistency. Therefore the description does not accurately represent the code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a full-featured multi-strategy quantitative investment research platform with extensive capabilities across multiple index-enhancement, active quant, high-frequency volume-price, and specialty strategies. The supplied code chunk, however, is only a configuration module. It is limited to parameter definitions for an HS300-focused morning report workflow: factor lists, weights, stock pool rules, technical-analysis parameters, output/log/cache settings, and a disclaimer. While the code is related to HS300 multi-factor research at a high level, it materially under-delivers relative to the declared capabilities and scope. There is no evidence here of the nine added strategy systems, correlation analysis, performance benchmarking, or asset-allocation advice, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description presents a full 'multi-strategy quantitative stock selection platform' with nine strategy systems and analytical outputs such as stock scoring, factor research, strategy correlation, performance comparison, and asset allocation advice. The code chunk, however, is specifically a data fetcher module. Its real responsibilities are collecting and caching daily stock/index data, valuation/fundamental metrics, exchange data, and pywencai query results from external providers. While these functions support a larger quant research system, they do not by themselves realize the declared primary capabilities. Additionally, the code exposes some undeclared operational capabilities such as downloading SZSE announcement PDFs and querying exchange announcements, which are adjacent but not reflected in the description. Therefore the supplied code does not accurately represent the declared end-user purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The description presents a full-featured multi-strategy quantitative research and stock-picking system, including numerous strategy frameworks and portfolio-level analytics. The supplied code, however, is a narrow factor engine: it calculates valuation, quality, growth, moving averages, MACD, RSI, KDJ, momentum, volatility, volume, and trend factors; combines them into group and composite scores; and emits textual explanations. This is related to multi-factor stock research, so the description is not wholly unrelated, but it materially overstates the implemented functionality. Core declared features such as multiple strategy systems, strategy correlation analysis, performance comparison, and asset allocation advice are absent from this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description substantially overstates the system’s scope. The code is a v5.1 script, not the declared v6.0 multi-strategy platform. Its actual core behavior is limited to fetching CSI 300 constituents, selecting roughly the first 20 codes, retrieving price/fundamental data, calculating basic MACD/KDJ/moving-average and valuation/growth-based scores, and printing a simple report. That supports part of the declared use case (A-share/HS300 stock scoring plus basic fundamental/technical analysis), but major declared capabilities are absent: no 9 strategy framework, no strategy correlation analysis, no performance comparison, and no asset allocation advice. Additionally, the code uses external resources with hardcoded JQData credentials, which is a material undeclared access pattern. Therefore the declared description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该描述与代码行为存在明显不匹配。描述把技能定位为一个覆盖沪深300、多因子选股、多策略量化、个股基本面/技术面分析、投研日报、评分、绩效对比、资产配置等广泛功能的投研平台；但代码只实现了一个非常具体的集合竞价量比分析脚本。它分析的股票池也不是完整沪深300，而是20只手工指定代表性个股。计算内容局限于集合竞价成交量、成交额、买一卖一、近5日均量对比和流通股本换手率，缺少描述中的核心能力。此外，代码还包含未声明的外部数据服务访问及明文账号凭据。综合来看，实际功能比声明狭窄且方向不同，属于实质性描述不符。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a full-featured quantitative stock selection and research platform with multiple strategy families and advanced analytical outputs. However, the supplied code chunk is limited to configuration data for a narrower HS300 morning report system. It supports the general theme of HS300 multi-factor research, but materially overstates the implemented behavior. Since the actual code does not demonstrate the advertised multi-strategy engine, scoring/report generation logic, correlation/performance/asset allocation analysis, or trigger enforcement, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents an investment research and quantitative stock-selection system with multiple strategy and analysis capabilities. However, the supplied code chunk does not implement any stock analysis, factor modeling, scoring, strategy comparison, or asset allocation logic. Its actual role is operational: it schedules and launches another script once per day via subprocess. While this may be a supporting component of the broader system, the code chunk itself has a materially different primary purpose from the declared analytical functionality. Therefore this chunk does not accurately represent the declared description on its own.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a comprehensive 'multi-strategy quantitative stock selection platform' with factor research, scoring, report generation, strategy analytics, and allocation advice. The supplied code, however, is only the data_fetcher.py module, whose actual role is collecting and caching market/fundamental/exchange data from Eastmoney, Tushare, AKShare, JQData, pywencai, SZSE, and SSE. That behavior supports such a platform, but does not itself implement the core declared capabilities like factor modeling, stock ranking, strategy correlation, performance comparison, or allocation advice. Additionally, the code exposes undeclared exchange-announcement/PDF download and IPO/listing retrieval features. Because the actual code chunk is materially narrower in purpose and includes some extra data-access capabilities absent from the description, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 87% confidence
- Finding
The description presents a broad, production-like multi-strategy quantitative research platform with strategy orchestration, stock selection across multiple strategy families, correlation/performance analysis, asset allocation advice, and support for both fundamental and technical analysis. The supplied code, however, is a narrow factor computation component. It calculates technical and market-based indicators from daily OHLCV-style data and combines some into a composite score. While this is consistent with part of a multi-factor stock scoring system, it does not substantiate most of the declared capabilities. In particular, the code lacks implementations for the named strategy families, any correlation/performance analytics, asset allocation logic, or genuine fundamental data handling. Because the declared description materially overstates the primary purpose and capabilities compared with the actual code chunk, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description presents a full-featured multi-strategy quantitative stock-selection and research platform with many strategy families and portfolio-level analytical capabilities. The supplied code is much narrower: it calculates valuation, quality, growth, moving averages, MACD, RSI, KDJ, momentum, volatility, volume, and trend factors, then standardizes and combines them into composite stock scores. This supports part of the declared stock scoring/basic analysis purpose, but it does not realize the majority of the claimed system capabilities such as multiple strategy frameworks, correlation analysis, performance benchmarking, asset allocation advice, or report generation. Therefore the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description overstates the system relative to the code. The code does perform CSI 300-related multi-factor stock analysis, scoring, and some basic fundamental/technical review, so it is directionally related. However, the declared purpose presents a much broader 'v6.0' multi-strategy platform with nine strategy families, correlation analysis, performance comparison, and asset allocation suggestions. None of those higher-level capabilities are implemented in the supplied chunk. Instead, the code is a narrower 'v5.1' script that ranks roughly the first 20 CSI 300 constituents using a hand-built scoring model and prints a report. Additionally, the script contains hardcoded JQData authentication credentials and accesses external data providers, which is a meaningful undeclared capability/resource access aspect. Therefore the description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description overstates the system substantially. The code does match part of the declared purpose: it is a HS300-oriented multi-factor-style daily research/reporting script that scores stocks and generates an investment-research report. However, its actual scope is much narrower and simpler than claimed. It only analyzes 20 hardcoded representative stocks rather than the full HS300 or broader A-share universe, and uses a limited, simplified technical scoring model based on momentum, moving averages, RSI, MACD, and KDJ. There is no implementation of the numerous advertised strategy families, no HS500/HS1000 coverage, no high-frequency/monthly/weekly 16-factor framework, no STAR board strategy logic, no strategy correlation/performance comparison module, and no genuine fundamental analysis. Therefore the declared description does not accurately represent the supplied code's real capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents the skill as a full-featured quantitative research and stock-selection platform with numerous analytical capabilities. However, the supplied code chunk is only a scheduling/heartbeat wrapper: it checks whether it is around 08:30, avoids duplicate daily runs via a marker file, invokes another script through subprocess, and prints the latest report file. That is materially different from the declared primary purpose. While this script may support the larger system, the code shown does not itself perform the described analysis and introduces an undeclared operational capability (scheduled execution). The explicit versioning also conflicts with the description: code is labeled v3.0, while the declaration claims v6.0 with expanded strategy coverage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full-featured quantitative stock research and selection system with multiple strategy families and analytical outputs. The supplied code does not implement any of those capabilities; it merely stores JoinQuant/JQData login credentials and an enable/disable flag. While such configuration could be a supporting detail in a larger system, this chunk by itself exposes an undeclared external data dependency and hardcoded credentials, which are materially different from the claimed behavior of performing factor research, scoring, or reporting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code chunk is clearly related to HS300 multi-factor research, so it is not unrelated. However, the declaration substantially overstates the implemented scope visible here. The actual code is a task runner for a morning HS300 factor-analysis pipeline: fetch constituents, get market/stock data, compute factors/scores, and generate reports. It does not demonstrate the advertised nine strategy families, correlation/performance/allocation analytics, or broad on-demand coverage for arbitrary A-share and individual-stock analysis. Additionally, the code supports scheduled daily execution, an operational capability not described in the declared purpose. Therefore the description does not accurately represent the behavior shown.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents an end-user-facing quantitative research/stock analysis skill with extensive strategy and analysis capabilities. However, the supplied code chunk does not implement those analytical functions; it only serves as an OpenClaw scheduled-task entry script that invokes another program. While this may support the larger system, the chunk’s primary behavior is operational orchestration and automation, which is materially different from the declared analytical purpose and introduces an undeclared trigger mode (daily scheduled execution). Therefore this specific code chunk does not accurately match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The description presents a large, feature-rich multi-strategy quantitative stock selection and research platform covering multiple universes and advanced analytics. The supplied code chunk is much narrower: it only generates and saves daily research reports based on an input DataFrame of already calculated factors and optional market data. It does include some aligned functionality—HS300-oriented reporting, stock scoring presentation, technical signal summaries, and lightweight investment suggestions—but it does not implement the majority of the declared strategy systems or advanced analyses. Therefore, the declared description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description overstates the implemented functionality. The code does fit part of the declared theme: it produces a HS300-style research daily and stock scoring based on multiple simple factors, and includes technical analysis plus a basic investment suggestion section. However, it does not implement the majority of the claimed platform capabilities. There is no evidence of 9 strategy systems, no broad quantitative strategy framework, no correlation or performance-comparison module, no asset-allocation engine beyond simple text heuristics, and no fundamental analysis. It also analyzes only a hardcoded subset of 20 stocks and runs as a batch script rather than a general-purpose skill responding to varied user queries. Resource access is consistent with stock analysis (fetching market data, writing reports), but the primary scope is materially narrower than declared.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The description substantially overstates the implemented functionality relative to this code chunk. The code does perform a related task—HS300-oriented multi-factor stock analysis and daily report generation—so it is not unrelated. However, the declared description presents a much broader and more advanced 'v6.0' platform with multiple strategy families across indices and boards, plus correlation, performance comparison, and broader fundamental/technical analysis coverage. In contrast, the supplied code is clearly labeled v2.0, uses a hardcoded small sample of HS300 stocks, generates mock data, and produces a single report workflow centered on factor scoring, technical signals, risk filtering, and market regime assessment. This is a material description-behavior mismatch due to inflated scope and capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The description materially overstates the skill compared with the supplied code. The code’s primary behavior is a simplified technical-analysis reporting script: it creates simulated data, scores a fixed stock list using basic momentum/technical signals, labels simple risk, and writes a markdown report. It does not implement the declared v6.0 breadth of strategy families, multi-index coverage, correlation analysis, performance benchmarking, or substantive asset allocation functionality. It also lacks fundamental-analysis logic and uses demo/synthetic rather than real market data. While the code is related to HS300 multi-factor research in a loose sense, the declared description is not an accurate representation of this code chunk’s actual capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The code clearly belongs to the same general domain as the description: an HS300/A-share multi-factor research and stock-scoring tool combining technical and fundamental analysis to produce a daily report. However, the declared description substantially overstates the implemented system. The script is explicitly labeled v3.0, not v6.0, and operates on a hardcoded set of 20 stocks rather than a broad multi-strategy quant platform. Its implemented capabilities include factor calculation, market regime assessment, risk filtering, pywencai supplemental signals, and report generation. But the declared 9 major strategy families, strategy correlation analysis, performance comparison, and richer asset allocation capabilities are not present in this code chunk. Therefore, the description does not accurately represent the actual behavior, even though there is partial thematic overlap.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description materially overstates the skill. The code does perform a related task—technical scoring and report generation for HS300-like stocks—but only in a simplified, simulated form. It lacks the claimed v6.0 breadth, the nine strategy families, support for HS500/1000 and STAR board, strategy correlation and performance comparison, and any true fundamental analysis. Its primary behavior is a local script that generates synthetic data, scores a small fixed stock list, and writes a markdown report. That is meaningfully narrower and different from the declared production-grade multi-strategy quant research platform.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad quantitative research and stock-selection system with many strategy and analysis capabilities triggered by user requests. The supplied code chunk, however, is only a scheduling/execution utility: it invokes another script, checks whether the current time is within 8:25–8:35, looks for a generated report file, and returns its contents. This is a materially different primary purpose from the declared end-user analytical platform. While this script may support such a system, the code shown does not itself perform the declared analyses and adds an undeclared scheduled-task capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents the skill as a quantitative research and stock analysis system with multiple strategy families and analytical outputs. However, the supplied code chunk is not implementing those research or stock-selection capabilities; it is a scheduling wrapper whose primary purpose is operational automation. It sets up a daily timer, may install a dependency, prompts the user interactively, and launches another script. These are materially different capabilities from the declared user-facing analytical purpose and are not mentioned in the description. While a scheduler could be a supporting component of such a system, this specific code chunk's actual behavior is infrastructure/orchestration rather than the declared analysis functionality, so the description does not accurately represent what this code chunk actually does.
- Content