Akshare Stock

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 0.1.0

Overview

The skill is a China A-share market-data helper with expected Python/package-install behavior, but its referenced CLI script is missing and the dependency install is not pinned.

Install only in an isolated Python environment, consider pinning and reviewing the AkShare version first, and note that this published artifact appears incomplete because the documented CLI script is absent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Supply-chain exposure through an unpinned package
Risk Level: Medium

Vulnerable Code

bash

pip install akshare

Technical Analysis

The skill instructs the agent to install akshare from pip without specifying an exact version or verifying package integrity. Consequently, the installed artifact depends on whichever release and distribution file the package index serves at execution time.

Because dependency resolution is not reproducible, future package releases, compromised maintainer credentials, compromised distribution infrastructure, or malicious transitive dependencies could introduce code that was not present during this audit. The skill explicitly permits Bash(pip3:*), making package installation an expected agent action.

The referenced scripts/akshare_cli.py file is absent from the audited project, so its claimed retry, error-handling, and data-processing behavior could not be validated. This absence is a completeness problem rather than evidence that the missing script itself is malicious.

Attack Path

1. An attacker compromises the upstream akshare release process, package-maintainer account, package-index delivery path, or one of its unresolved transitive dependencies.
2. The attacker publishes or causes pip to resolve a malicious newer distribution.
3. An agent follows the documented environment-preparation instruction and runs pip install akshare.
4. Pip downloads and installs the attacker-controlled artifact because no version, hash, lock file, or trusted local artifact constrains resolution.
5. Malicious code may execute during source-package build processing or when the installed package is subsequently imported and used.
6. The payload operates with the permissions of the account running pip or Python.

Impact Assessment

Successful exploitation could execute arbitrary code with t ...[truncated 400 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin AkShare to a reviewed exact version, for example akshare==X.Y.Z.
2. Maintain a lock file that pins all transitive dependencies rather than constraining only the top-level package.
3. Require cryptographic hashes for every resolved artifact, such as with pip install --require-hashes -r requirements.txt.
4. Download dependencies through an approved internal mirror or artifact repository and scan them before release.
5. Prefer reviewed binary wheels and disable unexpected source builds where feasible.
6. Install dependencies inside an isolated virtual environment or container under a non-privileged account.
7. Commit the referenced CLI implementation to the package so its behavior and imports can be audited.
8. Add automated dependency vulnerability, provenance, and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill metadata and description are entirely scoped to A股/A-share analysis in Chinese, which imposes a specific language and locale context. While the market scope is evident, the file does not explicitly state that this is a China-market-specific skill or offer any user choice on language/locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.