缠论技术分析

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:35 AM UTC
• Version: 1.1.0

Overview

The skill appears to be a market-analysis tool, but its setup asks users to install unpinned packages into the system Python environment, which warrants review before use.

Review the install step before using this skill. Prefer running it in a dedicated virtual environment with pinned dependency versions, and avoid `--break-system-packages` unless you intentionally accept changes to the system Python environment. Treat the output as market-analysis reference only, not financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Dependencies Installed Outside an Isolated Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–14
Vulnerability Type: Unpinned third-party dependencies and unsafe package installation guidance
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip3 install yfinance numpy --break-system-packages
python3 scripts/analyze.py BTC-USD
python3 scripts/analyze.py 0700.HK

Technical Analysis

The installation command retrieves yfinance, numpy, and their transitive dependencies without specifying approved versions or verifying package hashes. Consequently, the installed code can change between installations without any corresponding change to the reviewed skill package.

The --break-system-packages option bypasses protections intended to prevent pip from modifying an externally managed Python environment. This can cause dependency conflicts or replace packages used by system-level or unrelated Python applications. Although the named packages are legitimate, the documented installation process does not provide version locking, integrity verification, or environment isolation.

The project does not contain evidence that it deliberately retrieves and executes a malicious package. The risk arises from the unsafe dependency installation procedure and exposure to compromised releases, dependency substitution, mutable transitive dependencies, and incompatible future versions.

Attack Path

1. A user follows the quick-start instructions in SKILL.md.
2. pip3 resolves the latest available versions of yfinance, numpy, and all transitive dependencies from the configured package index.
3. An attacker compromises an upstream package or release, or controls a package index configured in the execution environment.
4. The malicious package executes installation-time or import-time code.
5. When scripts/analyze.py imports yfinance or numpy, attacker-controlled code executes with the privileges of the user running the command.
6. Be ...[truncated 916 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages from the installation instructions.

2. Require installation inside a dedicated virtual environment:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

3. Add a lock file or fully pinned requirements.txt containing exact versions for direct and transitive dependencies.

4. Record and enforce cryptographic hashes with --require-hashes.

5. Review dependency updates before changing locked versions and use automated vulnerability scanning.

6. Install from a trusted, explicitly configured package index and prevent fallback to untrusted indexes.

7. Run the analysis under a non-privileged account with only the filesystem and network access required for market-data retrieval.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and the entire README content are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings that set the skill's interface language to Chinese by default, including the module docstring and later user-facing print statements. Because the script does not offer any locale selection or document a justified region-specific constraint, it violates the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.