Security audit

东方财富网条件选股

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised Eastmoney stock screening, with limited local persistence and CSV export risks users should understand.

Install only if you are comfortable sending stock-screening queries to Eastmoney and leaving result CSVs plus an Eastmoney fingerprint cache in the workspace. Open generated CSV files in protected-view or a plain text viewer unless the publisher adds formula sanitization.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/em_stock_selector.py:118
Finding: CSV Formula Injection in Exported Stock Data
Content: View full analysis
Remediation: View remediation
str: text = str(value if value is not None else "") if text.startswith(("=", "+", "-", "@")): return "'" + text return text ``` Use it for both headers and data: ```python writer.writerow([sanitize_csv_cell(value) for value in display_header]) for row in all_data: writer.writerow([ sanitize_csv_cell(row.get(key, "")) for key in header ]) ``` Additional hardening measures: 1. Treat all remote API fields as untrusted input, even when they come from an expected HTTPS endpoint. 2. Document that generated files contain external data and should be opened using protected-view settings. 3. Add unit tests covering cells beginning with `=`, `+`, `-`, and `@`, including values preceded by tabs or other whitespace that spreadsheet applications may ignore. 4. Consider sanitizing leading control characters and whitespace before checking for formula prefixes. 5. If preserving exact raw values is required, export to a format with explicit string cell types, such as a properly generated XLSX file, instead of relying on CSV interpretation. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill advertises only high-level stock-selection behavior, but static analysis detected code capabilities involving file read/write without any declared tool scope or permissions boundary. Undeclared local file access increases the risk of data exposure or unintended filesystem modification, especially if the agent framework auto-grants capabilities based on implementation rather than explicit policy.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation text is broad enough to match many generic finance requests such as market analysis, stock screening, and criteria queries, which can cause over-triggering. That is dangerous because an over-broad finance skill may be invoked in contexts the user did not intend, leading to unnecessary external access, unintended actions, or misleading reliance on this skill's outputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file hard-codes Chinese locale/category labels such as "A股", "港股", and Chinese-only query/help text, and the CLI only accepts those values. This creates a language/locale constraint in the skill's natural-language interface without any user opt-in or documented justification for restricting usage to Chinese.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code persists a fingerprint cookie-derived identifier to workspace/fingerprint_cache.json, creating a durable local side effect beyond transient stock screening. Even if intended for performance, persistent storage of tracking/session-like data can expose user activity context or be reused by other components with workspace access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill writes fetched query results to CSV files in the workspace, which is a non-obvious data persistence behavior not described by the skill metadata. This can leave behind sensitive or proprietary user screening criteria and results, making them accessible to other local processes or later sessions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.