Back to skill

Security audit

沪深300多因子投研系统 v6.0 — 多策略量化选股平台

Security checks across malware telemetry and agentic risk

Overview

This finance skill mostly matches its research purpose, but it ships hardcoded third-party credentials and has misleading data-source and analysis-scope claims that users should review before installing.

Install only after the publisher removes and rotates embedded JQData/Tushare credentials, makes JQData status truthful across all scripts, disables runtime package installation, and clearly labels demo or synthetic-data outputs. Treat any generated report as informational only, not investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (70)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import schedule
    except ImportError:
        print("正在安装 schedule 库...")
        subprocess.run([PYTHON_CMD, '-m', 'pip', 'install', 'schedule'], capture_output=True)
        import schedule
    
    # 设置定时任务 - 每天8点执行
Confidence
88% confidence
Finding
subprocess.run([PYTHON_CMD, '-m', 'pip', 'install', 'schedule'], capture_output=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises and documents shell execution, file access, and network retrieval but does not declare permissions or user-consent boundaries. In an agent setting, this weakens runtime governance and can lead to unexpected command execution, local file access, or outbound requests when the skill is auto-invoked.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior extends beyond a simple research skill into credentialed third-party access, scheduled/automated execution, broader scraping, and possible sensitive token exposure. This mismatch is dangerous because users and the host agent may authorize the skill under incomplete assumptions, increasing the chance of secret leakage, unapproved network activity, and over-privileged operation.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script embeds a live JQData username and password directly in source code, exposing reusable credentials to anyone who can read, copy, or log the file. In a research skill, this creates unauthorized account-access risk unrelated to the analytical logic and may enable data abuse, billing impact, or lateral reuse if the password is shared across services.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The output states or strongly implies analysis of '沪深300成分股', but the program actually processes only 20 manually selected stocks. This is a trust and integrity issue: users may make investment or operational decisions based on materially incomplete coverage while believing the analysis is representative of the full HS300 universe.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The module header states JQData is disabled, but the implementation still imports credentials, authenticates, and queries JQData in multiple code paths. This mismatch can cause unexpected external data transmission and credential use, which is especially risky in an agent skill where operators may rely on documentation to understand network and privacy behavior.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The file embeds live JQData credentials directly in source code via jq.auth('13918681158', 'Yindb1158'). Hard-coded secrets are a real security issue because anyone with access to the skill can reuse the account, exfiltrate data, incur charges, or abuse the provider account without authorization.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The file embeds a live JQData username and password directly in source code via jq.auth(...). Hard-coded secrets are highly sensitive because anyone with code access can reuse the credentials, abuse the account, consume paid quotas, or pivot into related systems if the password is reused elsewhere.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The skill is presented as an HS300/A-share research tool, but it also exposes functionality to download exchange announcement PDFs to local storage. That expands the capability surface beyond passive market-data retrieval into filesystem-writing and bulk document acquisition, which can be abused for unanticipated data download or storage consumption in an agent environment.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The pywencai_query method forwards arbitrary natural-language queries to an external service, which is materially broader than the stated HS300 multi-factor research purpose. In an agent setting, this creates a generic outbound query channel that can transmit user content or system-derived data to a third party, increasing data exfiltration and scope-creep risk.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The comments state JQData is disabled, but the implementation still logs in and uses JQData for valuation, financial indicators, and income retrieval. This mismatch is dangerous because operators and users may make trust decisions based on incorrect disclosures, while the code still performs credentialed third-party access and outbound requests.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The runtime banner claims JQData is disabled, yet the code still contains active login and query logic that may execute when credentials are configured. Misleading runtime status reduces operator awareness of actual external integrations and can hide unexpected credential usage or data transfers.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The file embeds live third-party credentials directly in source code via `jq.auth('13918681158', 'Yindb1158')`. Hard-coded secrets are a real security issue because anyone with code access can reuse the account, exhaust quotas, access paid data, or impersonate the owner; in an agent skill, this is more dangerous because the code may be widely distributed, logged, or exposed to downstream systems.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The module docstring presents the script as a repaired analysis tool with specific data sources, but the implementation performs authenticated access using embedded account secrets without disclosure. This mismatch increases operational and security risk because reviewers and users may not realize the skill contains live credentials and external account dependencies, making secret exposure and unauthorized use easier to miss.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The file contains a hardcoded third-party service username and password in plaintext. Even though JQ_AUTH is currently set to False, the credentials are still exposed to anyone who can read the repository or package, enabling unauthorized access, account abuse, and credential reuse attacks if the password is reused elsewhere.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
This is a real logic flaw: comprehensive_analysis stores the computed value under 'market_temperature', but get_position_suggestion reads regime_analysis.get('temperature', {}). As a result, position sizing silently ignores market-temperature adjustments and may recommend materially wrong exposure in a financial decision system, increasing risk of unsuitable trading guidance.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata promises broad HS300/A-share multi-factor research capability, but the implementation only evaluates a hardcoded list of 20 stocks with simplistic technical signals. In an investment-analysis skill, this mismatch can mislead users into believing they are receiving comprehensive coverage and robust factor analysis when they are not, which is a real integrity and trust issue even if it is not a classic code-execution flaw.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest suggests the skill responds to user-driven A-share/HS300 analysis requests, but the code always runs a fixed batch job over a predefined list and writes a local report. This can cause the agent to ignore user intent and return irrelevant or misleading analysis, which is especially risky in a financial decision-support context where users may rely on the output as if it were tailored to their request.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This is a real integrity vulnerability: the file presents itself as a沪深300/A股 research system, but the analysis is driven by a hard-coded stock subset and fully simulated index/price data. In a financial-analysis skill, fabricated data can mislead users into acting on false market signals, making the issue more dangerous than an ordinary demo-data mismatch because the output is formatted as credible investment research.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The documentation and console/report messaging describe the program as an upgraded production-grade投研系统, yet the implementation operates on demo data. This mismatch materially increases the risk of user deception because the surrounding language gives synthetic results an appearance of authority and operational readiness.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This file presents itself as a沪深300 multi-factor research and stock-selection system, but the core analysis is generated from synthetic random price series and a fabricated index path rather than real market data. In a financial-analysis skill, this is dangerous because users may rely on output that appears authoritative for investment decisions, creating material risk through deceptive or misleading automation.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The docstring and runtime banner claim blacklist filtering and data quality validation, but the code only prints those capabilities and does not implement real checks or filters. In an investment research skill, this can mislead downstream users or agents into trusting controls that do not exist, weakening risk management and increasing the chance of unsafe recommendations.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill claims沪深300多因子投研 and stock-selection capability, but the implementation only covers a small hardcoded stock list and generates synthetic random price series instead of using real market or user-supplied data. In a financial-analysis skill, this is dangerous because it can produce authoritative-looking but fabricated investment output, misleading users into making decisions on false premises.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest advertises broad strategy support such as宽基指增、主动量化、高频量价、科创板、相关性分析、绩效对比 and asset allocation, but the code only performs a narrow technical-scoring workflow and report generation. This mismatch is security-relevant because users may over-trust the skill’s outputs as covering advanced analyses that are not actually performed, creating deceptive decision support in a high-stakes financial context.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The scheduler contains self-updating package-install behavior unrelated to core scheduling logic, which introduces unnecessary supply-chain risk. In the context of an agent skill, this is more dangerous because startup of an otherwise routine research tool can trigger network-based dependency installation and code execution without explicit operator review.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.