Security audit

三层筛网量化选股v1.0

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent A-share stock-screening tool, but it embeds undisclosed JQData credentials and its documented screening method does not match the code closely enough for a finance workflow.

Review carefully before installing. Do not use this package with the embedded JQData credentials; they should be removed and rotated by the publisher. Treat outputs as informational only, because the actual stock universe and filters differ from the SKILL.md description, and use pinned dependencies in an isolated environment if testing it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: quant_selector.py:24
Finding: Hard-Coded JQData Account Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:29
Finding: Unpinned Third-Party Runtime Dependencies
Content: View full analysis
Remediation: View remediation
--hash=sha256: jqdatasdk== --hash=sha256: pandas== --hash=sha256: numpy== --hash=sha256: ``` 4. Install dependencies in an isolated virtual environment with the minimum required permissions. 5. Use only an explicitly approved package index over TLS. 6. Add automated dependency vulnerability and provenance scanning. 7. Test dependency upgrades before updating the lockfile rather than resolving new versions during ordinary installation. ]]>

other

Warning

Location: quant_selector.py:82
Finding: Documented Financial Risk Controls Are Not Implemented and Data Failures Are Silently Suppressed
Content: View full analysis
0 and ind_row['adjusted_profit'].notna().any(): profit = float(ind_row['adjusted_profit'].iloc[0]) if profit < 0: continue if len(val_row) > 0 and val_row['pb_ratio'].notna().any(): pb = float(val_row['pb_ratio'].iloc[0]) if pb > 10: continue if len(val_row) > 0 and val_row['market_cap'].notna().any(): mc = float(val_row['market_cap'].iloc[0]) if mc < 10: continue ``` Additional silent failure handling appears throughout the workflow, including: ```python except Exception as e: pass ``` and: ```python except: pass ``` The processed universe is also explicitly truncated: ```python stock_codes = stock_codes[:stock_count] ``` ### Technical Analysis `SKILL.md` describes first-layer controls based on debt ratio, operating cash flow, trading liquidity, and actual share price. The implementation does not retrieve or evaluate those metrics. Instead, it applies PB and market-capitalization thresholds, while its missing-data conditions allow candidates to continue when relevant records or values are unavailable. Broad exception handlers suppress failures while retrieving index constituents, scoring securities, and obtaining industry information. The final output therefore may be produced from an incomplete universe without a clear indication that material data retrieval or screening operations failed. The main workflow also defaults to a 500-security limit, despite documentation describing selection from the broader A-share market. These differences make the generated recommendations appear to have passed controls that were not actually executed. This is primarily an integrity and financial-safety defect rather than a mechanism for obtaining system privileges. ...[truncated 1363 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill documentation materially misrepresents behavior: it claims A股全市场 selection with specific first-layer filters, while the implementation reportedly uses a narrower stock universe, different filtering logic, and undeclared external credentials. This is dangerous because users and downstream agents may make financial decisions under false assumptions, and hidden credential use introduces an additional secret-handling and unauthorized external access risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains hardcoded JQData credentials and immediately uses them for external authentication. Plaintext secrets in source code are highly sensitive because they can be copied, reused, leaked through version control, or abused to access the linked third-party account outside the intended stock-selection workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Using hardcoded credentials for external authentication without any user-facing disclosure means the skill silently authenticates to a third-party service with embedded account data. In this context, that is especially dangerous because the skill is expected to do stock screening, not secretly carry reusable account secrets; an operator or downstream system could unknowingly expose or misuse them.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Plaintext authentication credentials are present in the source and can be disclosed through repository access, code review, logs, backups, or model/tool reuse. Because this skill operates in a normal application context, there is no legitimate need to expose secrets inline; their presence materially increases the chance of account compromise and downstream abuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger text is overly broad and can cause the skill to activate for generic stock-selection or recommendation requests without clear user consent or scope control. In a finance context, this increases the chance of unintended execution, over-reliance on a specific strategy, and recommendations being produced in situations where the user did not specifically request this methodology.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The usage section defines invocation conditions loosely, including broad phrases like generating stock recommendation lists, which can lead to accidental or inappropriate routing to this skill. Because this is a finance skill, ambiguous activation is more dangerous than in low-risk domains: it may steer users into a specific investment workflow without sufficient context, suitability checks, or methodology disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Natural-language strings throughout the file, including the module description, prompts, and output messages, are exclusively in Chinese. This imposes a specific language on users without opt-in or an alternative locale path, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation says layer 1 excludes stocks based on asset-liability ratio above 70% and bottom-20% average turnover, and later prints '剔除亏损/高杠杆/低流动性公司'. But the code actually filters on negative adjusted profit, PB > 10, and market cap < 10, without computing leverage ratio or trading-amount ranking.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill selects stocks '从A股全市场中' using a three-layer process, but the implementation restricts the universe to representative index constituents and then truncates to at most 500 symbols. This materially narrows the selection universe, so the actual behavior does not match the described scope of screening the full A-share market.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document content, headings, usage notes, and warnings are all presented only in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue unless the constraint is clearly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The layer-3 docstring states an industry cap of 3-5 stocks, while the code hardcodes max_per_industry = 5. Later output states '每行业最多3只', which contradicts the implemented cap and can mislead users about the portfolio-construction behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.