Security audit

Current Akshare List

Security checks for vulnerabilities and agentic risk

Overview

The skill is for fetching Chinese stock lists, but it also tells the agent to create recurring cron-based retry tasks with later agent turns, which needs user review before installation.

Review before installing. Use it only if you are comfortable running Python code that installs akshare and makes outbound market-data requests. Avoid enabling the cron retry option unless you explicitly approve the exact command, schedule, timeout, output path, and removal method; prefer manual retry or bounded in-process retry instead.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:149
Finding: Persistent Cross-Session Execution Through a Recurring Cron Task
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 声明的核心目标是汇总所有 A股/创业板/B股股票基础信息，并结合实时行情筛出当前交易与非交易股票，最终保存为 CSV。实际代码的主要功能只是分别拉取三个实时行情接口的代码和名称列表，并保存到 /tmp/*.json。它没有获取股票简况、上市时间，也没有把‘全部股票’与‘实时行情’做比对来识别停牌/不交易股票；同时输出介质与格式也不符。虽然代码包含‘接口封禁时提示开 VPN 重试’这一部分的部分行为，但缺少自动定时重试。整体上主功能与声明存在实质性不一致。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest states the skill will produce current trading and non-trading stock lists and save them as CSV. However, the comparison code only computes in_spot_not_stocklist and in_stocklist_not_spot and prints counts, while no code shown writes stocklist_intrading.csv or notspot.csv, so the documented implementation does not fulfill the described output behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Telling users to enable a VPN or set up automatic retries without a clear warning about privacy, policy, and system-side effects can push them toward network-routing changes or persistent automation they may not understand. In a skill context, this is dangerous because it normalizes bypassing network restrictions and may lead to unintended exposure of traffic or unmanaged background jobs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs automatic cron-based retry behavior that persists beyond the immediate task and is not essential to generating a stock list. Persistent scheduled execution can create unintended system modifications, repeated outbound network access, and hard-to-notice background activity, especially if created without explicit user consent and bounded implementation details.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The scheduled-task instructions describe creating a persistent cron job that retries for up to 12 hours and deletes itself on success, but they omit a strong user warning and consent step. Background automation with network access can consume resources, generate repeated outbound traffic, and be difficult for users to discover or stop if something goes wrong.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says the skill should build a current list of all active A-share, ChiNext, and B-share stocks, identify non-trading stocks, include code/name/listing date, and save the result as CSV after cross-checking with realtime quotes. This script only fetches realtime spot data for A股、B股、科创板, writes partial code/name JSON files to /tmp, and never computes active vs non-trading lists, listing dates, or CSV output.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The docstring states the script gets realtime data for A股、B股、科创板 and saves it, which matches the code, but this documented intent conflicts with the skill manifest's stated purpose of covering A股、创业板、B股 and producing current trading/non-trading stock lists. The inline documentation therefore reinforces an implementation direction that differs from the declared skill intent rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s docstrings and all user-visible console messages are written in Chinese, and the script does not provide any opt-in, configuration, or documentation indicating that the tool is intentionally limited to Chinese-speaking users. This creates a language/locale policy issue because the skill effectively enforces one language by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.