波龙股神量化交易系统

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:21 AM UTC
• Version: 2.1.3

Overview

This is a disclosed finance/trading skill, but it needs Review because it handles broker credentials and real-money trading commands with weak safeguards and some misleading analytics paths.

Review carefully before installing. Use only in an isolated environment, keep real broker credentials out of config files, avoid live mode unless you add confirmations and order limits, disable Telegram unless you accept sending alert data to that chat, and treat generated picks/backtests as demos unless you verify the data path and calculations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/executor_huaxin.py:139

Finding

Broker Credentials and Trade Commands Use Plaintext HTTP in the Huaxin QMT Client

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/executor_wenhua.py:225

Finding

Broker Credentials and Futures Orders Use Plaintext HTTP in the Wenhua Client

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (34)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/risk_monitor.py (reported line 101)May include surrounding context.

python

t
    daily_pnl_pct: float
    total_pnl: float
    total_pnl_pct: float
    drawdown: float
    drawdown_pct: float
    trade_count_today: int
    positions: List[Dict] = field(default_factory=list)


class TelegramNotifier:
    """Telegram通知器"""
    
    def __init__(self, token: str, chat_id: str):
        self.token = token
        self.chat_id = chat_id
        self.api_url = f"https://api.telegram.org/bot{token}"
    
    def send(self, message: str, parse_mode: str = "Markdown") -> bool:
        """发送消息"""
        if not self.token or not self.chat_id:
            logger.warning("⚠️ Telegram未配置，跳过通知")
            return False
        
        try:
            import requests
            url = f"{self.api_url}/sendMessage"
            payload = {
                "chat_id": self.chat_id,
                "text": message,
                "parse_mode": parse_mode
            }
            response = requests.post(url, json=payload, timeout=10)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · output/stock_picks/picks_momentum_20260327_193158.csv (reported line 1)May include surrounding context.

text

ts_code,name,score,pe,roe,revenue_growth,rsi,volume_ratio
000897,津滨发展,93.8468719602168,10.334817348116516,29.206032179638868,0.4359445187166855,54.61707571748609,2.9583441581493175
000004,*ST国华,92.70923382266864,11.570763241353035,27.850471565105202,42.672708382909796,50.67778751993203,2.8745552616247014
002516,旷达科技,92.62774577741506,16.377810480500166,29.342200173148154,3.6310930006151434,30.91843117386791,0.8919824784253967

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The close_all method performs bulk liquidation of all positions with no confirmation, no dry-run preview, and no mode-specific safety gate. In a trading executor skill, that creates a direct path to irreversible financial harm if the command is triggered accidentally, by automation error, or by prompt/agent misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI exposes buy, sell, cancel, and close_all actions and allows switching to live mode without any secondary confirmation or explicit safeguard for real-money operations. In agent or scripted environments, this makes unintended or manipulated invocation far more dangerous because a single command can place or unwind real trades immediately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script advertises itself as a quantitative stock-picking system, but the actual scoring logic in pick_stocks uses randomly generated PE, ROE, revenue growth, RSI, volume ratio, and capital-flow values instead of real fetched data. In a trading or investment context, this can mislead users into acting on fabricated outputs while believing they are data-driven, creating material financial risk and undermining trust in the tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README is written entirely in Chinese, including operational guidance and safety information, with no indication that alternative languages are available or that Chinese is a required locale. Under the policy, forcing a specific language without opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description includes an unusually broad set of search keywords spanning generic investing, stock trading, AI, and well-known names, which can cause the skill to be invoked in contexts far beyond its intended scope. In a skill that can guide or enable financial trading workflows, overbroad invocation increases the chance of accidental activation, user confusion, and exposure of sensitive trading-related functionality in inappropriate contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly documents use of trading account credentials and external Telegram push tokens, but does not provide clear security guidance on secret storage, least-privilege handling, masking in logs, or risks of transmitting account or trading data to third-party services. In a financial-trading context, this is more dangerous because compromised credentials or leaked notifications could expose account access, positions, balances, and trade activity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The inline comments say real usage should replace the demo data with a data source, implying the script is a backtesting entry point over actual market data. However, the implemented main path unconditionally generates random synthetic prices and never reads any real input dataset, so the documentation of intended behavior conflicts with what the code actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script claims the new stock-picking strategy enforces a PB<5 valuation filter, but no PB field exists in the sample data and no PB check is implemented in either the per-row filter function or the final selection logic. This creates a misleading discrepancy between documented behavior and actual execution, which can cause users to trust recommendations that do not satisfy the stated risk controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/executor_huaxin.py (reported line 228)May include surrounding context.

python

**(params or {})
            }
            
            response = requests.post(
                self.config.api_url,
                json=payload,
                timeout=self.config.timeout

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/executor_wenhua.py (reported line 310)May include surrounding context.

python

**(params or {})
            }
            
            response = requests.post(
                self.config.api_url,
                json=payload,
                timeout=self.config.timeout

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, CLI help text, and user-facing logs are entirely in Chinese, which effectively imposes a specific language on users. The file does not offer any language/locale opt-in or explain that the tool is intentionally restricted to a Chinese-only regulatory or regional context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This is a real logic flaw in a trading executor: close_position() maps a long position to sell_close() and a short position to buy_close(), but the mock trading layer stores and looks up positions using the closing order direction as part of the key. As a result, a requested close can fail to find the existing holding, leaving exposure open when the caller believes risk has been reduced or eliminated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Hardwiring the Telegram API endpoint establishes a built-in channel for sending data to an external service. While not inherently malicious, in this skill context it enables off-system transmission of potentially sensitive account alerts and therefore constitutes a real data-exposure risk when combined with notification content.

Content

Scanner excerpt · scripts/risk_monitor.py (reported line 101)May include surrounding context.

python

def __init__(self, token: str, chat_id: str):
        self.token = token
        self.chat_id = chat_id
        self.api_url = f"https://api.telegram.org/bot{token}"
    
    def send(self, message: str, parse_mode: str = "Markdown") -> bool:
        """发送消息"""

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This outbound HTTP POST transmits alert content to Telegram, which may include sensitive trading and account telemetry. In the context of a risk-monitoring skill, external transmission is expected functionality, but it still expands the attack surface and can expose confidential financial data if tokens, chats, or network paths are compromised.

Content

Scanner excerpt · scripts/risk_monitor.py (reported line 117)May include surrounding context.

python

"text": message,
                "parse_mode": parse_mode
            }
            response = requests.post(url, json=payload, timeout=10)
            result = response.json()
            
            if result.get("ok"):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script sends account- and risk-related data to Telegram, an external third-party service. Even though this appears to be an intended notification feature rather than covert exfiltration, transmitting financial monitoring data off-host can leak sensitive operational information if users are unaware, if the chat is misconfigured, or if the bot token/chat target is compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains prominent natural-language descriptions and CLI help text that assume a Chinese-speaking user base, but there is no opt-in, language selection, or justification that the tool is region- or locale-specific. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The argparse description and help messages are user-facing natural-language strings, and all are provided only in Chinese. Because no alternative language or opt-in mechanism is offered, this violates the language/locale policy for organizational text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file presents its title and descriptive instructions only in Chinese, which effectively forces a specific language on users. The policy requires either user opt-in for a specific language/locale or a clearly documented and justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language docstrings, logs, CLI help text, and report content entirely in Chinese, indicating the skill forces a specific language experience. Under the policy, language or locale constraints should be optional, user-selectable, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring claims RPS is a market-relative ranking, but the implementation is only a heuristic derived from the stock's own return bands. In a stock-picking tool, this mismatch can materially mislead users about the meaning and reliability of the indicator, causing incorrect investment decisions based on falsely labeled analytics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The operational interface shown in log messages, argument descriptions, warnings, disclaimer text, and the generated report is entirely Chinese. This is a natural-language policy issue because users are not given a choice of language and the locale restriction is not explicitly justified in the file.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 386)May include surrounding context.

md

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language comments and labels in this file are consistently Chinese, with no indication that another language is supported or that Chinese is a required locale. Per the policy, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.