Stock Daily Analysis

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The skill mostly fits stock analysis, but its install/update scripts can pull and run changing GitHub code and its AI integrations send analysis data to configurable external services.

Review the install and update scripts before running them, avoid running them with privileged accounts, pin the upstream repository and Python dependencies if you use them, and only configure AI providers or proxies if you are comfortable sending stock symbols and technical-analysis data to those services. Keep API keys out of shared directories and remove unmanaged .env backups.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/setup.sh:23

Finding

Mutable Remote Repository Is Retrieved and Subsequently Executed

Content

View full analysis

Remediation

View remediation

" git clone --no-checkout "$REPO_URL" "$PROJECT_DIR" cd "$PROJECT_DIR" git checkout --detach "$REPO_COMMIT" ``` 2. Prefer signed, versioned release tags and verify the signature before installation: ```bash git tag -v "$RELEASE_TAG" ``` 3. Do not automatically pull and execute the latest default branch. Make updates explicit and require review of the commit difference before installation. 4. Verify downloaded release archives against a trusted SHA-256 digest when Git signature verification is unavailable. 5. Separate retrieval from execution. Display the resolved commit hash and require approval before installing dependencies or running newly retrieved code. 6. Run installation and analysis under an unprivileged, isolated account with only the filesystem and network access required for stock analysis. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Dependencies Use Unbounded Lower-Bound Versions Without Integrity Verification

Content

View full analysis

=1.12.0 pandas>=2.0.0 numpy>=1.24.0 requests>=2.31.0 openai>=1.0.0 python-dotenv>=1.0.0 ``` From `scripts/setup.sh:41-42`: ```bash echo "Installing Python dependencies..." "$VENV_DIR/bin/pip" install -q -r requirements.txt ``` From `scripts/update.sh:29-31`: ```bash # Update dependencies echo "Updating dependencies..." pip3 install -q -r requirements.txt ``` The README also recommends direct unpinned installation at `README.md:24`: ```bash pip3 install akshare pandas numpy requests ``` ### Technical Analysis Every dependency is specified with a lower-bound constraint rather than an exact reviewed version. Future versions satisfying these constraints can therefore be selected automatically. No package hashes are provided, and the scripts do not enforce installation from a locked, reviewed artifact set. Python package installation may execute package build backends or installation-related code. A compromised publisher account, malicious future release, dependency-confusion event, or compromised package distribution channel could consequently introduce attacker-controlled code during setup or update. The use of the public Python package ecosystem is necessary for the Skill's declared functionality, but automatically accepting arbitrary future versions is not. Exact versions and cryptographic hashes would preserve functionality while reducing the required supply-chain trust. ### Attack Path 1. An attacker gains control of a listed package or one of its transitive dependencies, or publishes a compromised future version. 2. The malicious version still satisfies the broad `>=` constraint. 3. A user runs `scripts/setup.sh`, `scripts/update.sh`, or the instal ...[truncated 930 chars]

Remediation

View remediation

pandas== numpy== requests== openai== python-dotenv== ``` 2. Generate a lock file containing all transitive dependencies and SHA-256 hashes. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Use a controlled package index or internal artifact mirror and explicitly configure trusted sources. Do not add untrusted extra indexes. 4. Review dependency updates before changing the lock file. Add automated vulnerability, provenance, and license scanning to the update process. 5. Use the virtual-environment interpreter consistently in `scripts/update.sh`: ```bash "$VENV_DIR/bin/python" -m pip install --require-hashes -r requirements.lock ``` 6. Update the README so its installation instructions use the same locked and hash-verified dependency set rather than direct unpinned package installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (50)

Tainted flow: 'proxies' from os.environ.get (line 84, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The Gemini path trusts HTTPS_PROXY/https_proxy from the process environment and forwards all outbound model traffic through that proxy. In a skill context, this can redirect API requests and responses—including prompts, stock symbols, technical indicators, and the API key in the query string—to attacker-controlled infrastructure, enabling data exfiltration or response tampering.

Content

Scanner excerpt · scripts/ai_analyzer.py (reported line 86)May include surrounding context.

python

if proxy_url:
            proxies = {'https': proxy_url, 'http': proxy_url}
        
        response = requests.post(url, headers=headers, params=params, json=data, timeout=30, proxies=proxies)
        response.raise_for_status()
        
        result = response.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is stock analysis, but detected behavior includes self-update via git pull, local configuration backup, and dependency installation/update with pip3. Hidden maintenance or code-modifying actions materially expand risk because they can alter the runtime, pull unreviewed code, expose secrets in config files, or execute package install hooks outside user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Allowing a caller-supplied skill_path means an attacker who can influence configuration can point the fetcher at an arbitrary directory containing a malicious scripts/quote_cn_pro.py, which this code will then execute. In a stock-analysis skill, this is especially dangerous because the feature appears innocuous while actually enabling arbitrary local code execution under the agent's privileges.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 23)May include surrounding context.

sh

# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 25)May include surrounding context.

sh

# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 50)May include surrounding context.

sh

# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 22)May include surrounding context.

sh

cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 24)May include surrounding context.

sh

cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 49)May include surrounding context.

sh

cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/update.sh (reported line 20)May include surrounding context.

sh

cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Copying .env to timestamped backup files duplicates credentials and secrets, increasing their exposure surface and retention period. In this stock-analysis skill context, .env likely contains API keys for market data or related services, so unmanaged backups can leave sensitive tokens lying around in the project directory where they may be committed, read by other users, or included in archives.

Content

Scanner excerpt · scripts/update.sh (reported line 22)May include surrounding context.

sh

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

# 拉取最新代码

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file uses Chinese throughout for headings, instructions, and conclusions, but does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README documents configuring third-party AI providers and encourages AI-based stock analysis, but it does not clearly disclose that user-provided stock symbols, prompts, and potentially derived portfolio/watchlist context may be transmitted to external services. This creates a privacy and compliance risk because users may unknowingly send sensitive financial interests or trading intent to DeepSeek or Gemini.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises code-capable behavior involving environment access, file reads, network, and shell, but does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may invoke powerful capabilities without clear least-privilege constraints or user visibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Overly broad trigger phrases such as generic stock-analysis requests increase the chance the skill activates in unintended contexts. In a code-capable skill, accidental activation can expose users to unneeded network, file, or shell operations and can cause the agent to act beyond the user's actual intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

md

"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.example.json (reported line 5)May include surrounding context.

json

"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s user-directed natural language is written entirely in Chinese, and the generated prompt requires responses in Chinese-specific output values such as '上涨/下跌/震荡' and '买入/持有/观望/卖出'. This imposes a specific language/locale behavior without offering the user any language choice or documented opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

The OpenAI client accepts a configurable base_url, which can redirect requests intended for OpenAI to any arbitrary endpoint. If an attacker can influence configuration, they can exfiltrate prompts and API credentials to a malicious server; this is more concerning in a finance skill that may process user portfolio/watchlist data.

Content

Scanner excerpt · scripts/ai_analyzer.py (reported line 31)May include surrounding context.

python

self.max_tokens = config.get('max_tokens', 4096)
        
        if self.provider == 'openai' and HAS_OPENAI:
            base_url = config.get('base_url', 'https://api.openai.com/v1')
            self.client = OpenAI(api_key=self.api_key, base_url=base_url)
        else:
            self.client = None

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Reading proxy settings from environment variables gives this stock-analysis skill an unnecessary network-routing capability not clearly justified by its purpose. That increases the attack surface because any compromised runtime, launcher, or wrapper that sets these variables can silently alter where sensitive outbound analysis traffic is sent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ai_analyzer.py (reported line 86)May include surrounding context.

python

if proxy_url:
            proxies = {'https': proxy_url, 'http': proxy_url}
        
        response = requests.post(url, headers=headers, params=params, json=data, timeout=30, proxies=proxies)
        response.raise_for_status()
        
        result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code sends stock identifiers, names, and technical-analysis data to external LLM providers, but there is no evident user-facing disclosure or consent mechanism in this file. In a finance-related skill, even if the data is not highly sensitive by itself, undisclosed third-party transmission creates privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring presents the skill description only in Chinese, and the rest of the user-facing descriptions/comments in this file follow the same pattern. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language documentation entirely in Chinese, which effectively imposes a specific language on users and maintainers. Under the policy, language constraints should either be optional for the user or clearly justified as region- or locale-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.