股票筛选入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.2

Overview

This stock-screening skill is not malicious, but it asks for broader execution and file-writing authority than its free, terminal-only description clearly justifies.

Review this skill before installing. Use it only in a constrained environment, install dependencies in a virtual environment, avoid granting write access unless you explicitly need file output, and do not let it handle unrelated reporting or generic data-analysis tasks. The artifact does not show credential theft, persistence, or destructive behavior, but its scope and permissions should be tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:143

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:143 and SKILL.md:229-230
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

At SKILL.md:143:

bash

pip install akshare pandas

At SKILL.md:229-230:

markdown

| akshare | Python library | Required | `pip install akshare` |
| pandas | Python library | Required | `pip install pandas` |

Technical Analysis

The documented installation commands retrieve the latest available versions of akshare and pandas from the Python package index configured in the user's environment. The project does not provide version constraints, a dependency lockfile, package hashes, or index restrictions.

Because package versions are not pinned, users may install dependency releases that were not reviewed by the Skill author. If a package distribution, maintainer account, package index, or configured mirror is compromised, a malicious release could execute attacker-controlled code during installation or when the Skill imports and uses the package.

The audit found no evidence that the named packages are currently malicious. The vulnerability is the absence of controls that ensure users install known, reviewed package artifacts.

Attack Path

1. An attacker compromises a dependency maintainer account, package release process, configured package index, or package mirror.
2. The attacker publishes or substitutes a malicious release of a required dependency.
3. A user follows the documented command:

   bash

   pip install akshare pandas
   

4. Package installation selects the malicious or compromised release because no approved version or artifact hash is specified.
5. Attacker-controlled code executes during package installation or when the dependency is imported at runtime.
6. The code runs with the privileges of the user or automation agent performing the installation.

Impac

...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version, for example:

   text

   akshare==REVIEWED_VERSION
   pandas==REVIEWED_VERSION
   

2. Generate and commit a lockfile containing exact transitive dependency versions.
3. Require package hashes, such as through a hash-locked requirements file and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Install packages only from an explicitly configured, trusted package index or an internally controlled artifact repository.
5. Review dependency provenance, release signatures where available, maintainer changes, and vulnerability advisories before updating locked versions.
6. Perform installations in an isolated virtual environment or container using a non-privileged account.
7. Add automated dependency and software-composition analysis to detect compromised, vulnerable, or unexpectedly changed packages.
8. Replace the unpinned installation commands in SKILL.md with instructions that use the reviewed lockfile.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation says the free version does not support export, but the capability section explicitly states it supports create/query/export operations. In an agent setting, contradictory instructions can cause the model to attempt data export or artifact creation anyway, potentially writing sensitive analysis outputs to disk or external destinations contrary to user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation wording is broad, repetitive, and includes generic data-analysis/reporting phrases unrelated to narrow stock screening. That increases the chance the skill is invoked for loosely related requests, exposing exec/write capabilities in contexts where the user did not specifically request this tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares both generic execution and file-writing permissions even though the free edition is documented as terminal-display only and non-exporting. This mismatch expands the agent's effective authority beyond user expectations, creating unnecessary risk of unintended command execution or file creation if the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The capability coverage is defined through vague keyword matching such as common words like 'Use', 'when', '数据分析', and '自动化', which could spuriously trigger the skill on unrelated prompts. In combination with execution-capable tooling, overbroad routing increases the likelihood of unnecessary code execution or file operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.