Stocktoday Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 2.0.3

Overview

The skill matches its financial-data purpose, but its API token can be sent through unsafe or user-supplied gateways, so users should review it before installing.

Install only if you are comfortable giving this skill a StockToday/Tushare API token and network access. Avoid the documented HTTP backup gateways, do not pass tokens directly in chat or logs, prefer an environment variable, and use only a trusted HTTPS gateway. Pin dependencies in a controlled environment before running the demo scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/proxy_demo.py:25

Finding

Plaintext Backup Gateways Can Expose API Credentials and Financial Data

Content

View full analysis

Vulnerability Details

File Location: scripts/proxy_demo.py:25-28 and SKILL.md:564-568
Vulnerability Type: Sensitive information transmitted over an unencrypted channel
Risk Level: High

Vulnerable Code

python

DEFAULT_GATEWAY = "https://tushare.citydata.club/"
BACKUP_GATEWAY_1 = "http://111.229.164.2:8083/"
BACKUP_GATEWAY_2 = "http://124.223.112.152:6331/"
BACKUP_GATEWAY_3 = "http://110.42.211.9:9900/"

The corresponding configuration documentation is:

markdown

| `TUSHARE_TOKEN` | (none) | Required API token |
| `TUSHARE_GATEWAY` | `https://tushare.citydata.club/` | Custom backend address |
| `TUSHARE_GATEWAY_BACKUP1` | `http://111.229.164.2:8083/` | Backup gateway 1 |
| `TUSHARE_GATEWAY_BACKUP2` | `http://124.223.112.152:6331/` | Backup gateway 2 |
| `TUSHARE_GATEWAY_BACKUP3` | `http://110.42.211.9:9900/` | Backup gateway 3 |

Technical Analysis

Three supported backup endpoints use plaintext HTTP. The Tushare client authenticates requests using TUSHARE_TOKEN; therefore, directing the client to one of these endpoints can transmit the token and API request contents without transport encryption or server authentication.

Although the current implementation does not automatically rotate through these constants, the endpoints are published as supported backup gateways and can be selected through the custom gateway configuration. An HTTP connection is vulnerable to passive interception and active man-in-the-middle modification.

Using raw IP addresses also prevents meaningful hostname-based identity verification. An attacker controlling a network segment, proxy, router, or DNS-independent traffic path could observe or alter API traffic.

Attack Path

1. A user follows the documented backup configuration or passes one of the HTTP backup addresses to get_client.
2. The client assigns that address to pro._DataApi__http_url.
3. An authenticated financial-data API meth ...[truncated 885 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all plaintext HTTP gateway definitions and documentation.
• Require HTTPS for every configured gateway and reject all other URL schemes.
• Use trusted DNS hostnames with valid TLS certificates instead of raw IP addresses.
• Maintain an explicit allowlist of approved gateway hostnames.
• Do not silently downgrade from HTTPS to HTTP during failover.
• Fail closed when TLS validation fails.
• Add tests verifying that HTTP URLs, IP-literal endpoints, and invalid certificates are rejected.
• Revoke and rotate any token known to have been transmitted through a plaintext endpoint.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/proxy_demo.py:31

Finding

Unvalidated Gateway Override Can Redirect API Tokens to an Attacker-Controlled Server

Content

View full analysis

Vulnerability Details

File Location: scripts/proxy_demo.py:31-43
Vulnerability Type: Untrusted endpoint configuration and credential disclosure
Risk Level: High

Vulnerable Code

python

def get_client(token: str = None, gateway: str = None) -> "ts.pro_api":
    """
    Get the Tushare Pro client routed through the StockToday gateway.

    Priority: function argument, TUSHARE_TOKEN environment variable,
    TUSHARE_GATEWAY environment variable, default gateway.
    """
    token = token or os.getenv("TUSHARE_TOKEN") or "your_token_here"
    gateway = gateway or os.getenv("TUSHARE_GATEWAY") or DEFAULT_GATEWAY

    pro = ts.pro_api(token)
    # Point the client at the StockToday gateway.
    pro._DataApi__token = token
    pro._DataApi__http_url = gateway
    return pro

Technical Analysis

The gateway may come from a caller-supplied argument or the TUSHARE_GATEWAY environment variable. The function assigns this value directly to the Tushare client's internal HTTP URL without validating its scheme, hostname, port, or ownership.

At the same time, the function assigns the user's token to the client. Subsequent authenticated API calls are consequently sent to whichever endpoint was supplied. A malicious value such as an attacker-controlled HTTPS server or a plaintext HTTP endpoint can receive the credential-bearing request.

This is a trust-boundary violation: a sensitive credential is coupled to an endpoint whose identity is not constrained by the code.

Attack Path

1. An attacker gains influence over the process environment, launch configuration, wrapper script, CI variables, or code that calls get_client.
2. The attacker sets TUSHARE_GATEWAY or the gateway argument to an attacker-controlled URL.
3. The victim runs a demo or invokes an API operation through the returned client.
4. The Tushare client sends the authenticated request to the attacker's endpoint.
5. Th ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the gateway using a standard URL parser before assigning it to the client.
• Require the https scheme and reject HTTP, local-file, and other schemes.
• Allow only explicitly approved hostnames, such as the official StockToday gateway.
• Reject IP literals, embedded credentials, fragments, unexpected ports, and malformed hostnames.
• Avoid modifying private client fields such as _DataApi__http_url where a supported endpoint configuration mechanism exists.
• Separate credential creation from endpoint selection so credentials are never attached to an untrusted destination.
• Log only the validated hostname, never credentials or complete credential-bearing URLs.
• Add unit tests for malicious environment values and attacker-controlled function arguments.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/proxy_demo.py:99

Finding

API Token Prefix Is Disclosed in Console and Agent Logs

Content

View full analysis

Vulnerability Details

File Location: scripts/proxy_demo.py:99-102
Vulnerability Type: Partial sensitive-information exposure through logging
Risk Level: Low

Vulnerable Code

python

if __name__ == "__main__":
    pro = get_client()
    print(f"✅ StockToday client initialized, gateway: {pro._DataApi__http_url}")
    print(f"   token: {pro._DataApi__token[:6]}***")

Technical Analysis

The demo prints the first six characters of the API token. Console output is commonly retained in shell histories, CI logs, Agent transcripts, support bundles, or centralized logging systems. Redacting only the suffix still discloses stable secret material.

A token prefix may identify a specific credential across logs, reduce the unknown search space, or assist correlation and social-engineering attacks. Secret values should not be printed even partially unless a deliberately generated, non-secret identifier is used.

Attack Path

1. A user runs scripts/proxy_demo.py with a real TUSHARE_TOKEN.
2. The script prints the first six token characters.
3. The output is retained by a terminal recorder, CI system, Agent execution log, or shared support transcript.
4. A person with access to those logs obtains the token prefix.
5. The prefix may be combined with another leak or used to correlate and identify the credential.

The exposed prefix alone is not shown to be sufficient for direct authentication, so the practical severity is lower than disclosure of the complete token.

Impact Assessment

The issue leaks six characters of a sensitive API credential to any party able to read execution output. It weakens secret confidentiality and may facilitate credential correlation or compound another disclosure.

It does not independently provide local privileges or conclusively grant API access without the remaining token value.

Remediation

View remediation

Remediation Suggestions

• Remove all output derived from the token.
• Replace the message with a boolean status such as authentication configured.
• If credential correlation is operationally necessary, use a server-provided account identifier or a deliberately generated non-secret fingerprint.
• Review CI and Agent logs for previously exposed prefixes and restrict access to retained logs.
• Add secret-detection checks that reject logging statements containing token variables or slices of token values.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Open-Ended Dependency Versions Permit Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text

tushare>=1.4.0
pandas>=1.0

The installation guidance also permits unconstrained resolution:

bash

pip install tushare pandas

Technical Analysis

Both dependencies specify only lower version bounds. Every future release that satisfies these constraints may therefore be installed without being reviewed with this project. There is no lockfile or package-hash verification to guarantee reproducible dependency resolution.

Python packages can execute code during installation and whenever imported. The scripts import both packages directly, and tushare handles the sensitive token and outbound API requests. A compromised upstream release, maliciously modified distribution, or incompatible future version could execute with the privileges of the user running the Skill.

The audit found no evidence that the current dependency names are typosquatted or intentionally malicious. The risk arises from accepting unreviewed future artifacts rather than from a confirmed malicious package version.

Attack Path

1. A future dependency release is compromised, malicious, or otherwise unsafe.
2. A user installs the project using the open-ended requirements or documented pip install command.
3. The package manager resolves the unsafe release because it satisfies the minimum-version constraint.
4. Package code executes during installation or import.
5. It runs with the invoking user's privileges and may access environment variables, including TUSHARE_TOKEN, network access, and user-accessible files.

This path depends on compromise or unsafe modification of an accepted upstream release.

Impact Assessment

Malicious dependency code would run with the same operating-system privileges as the Python process. It could read the API ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each direct dependency to an exact reviewed version.
• Generate a lockfile that includes transitive dependencies.
• Require cryptographic hashes for downloaded distributions, for example through a hash-locked requirements file.
• Install only from the official package index or an authenticated internal mirror.
• Perform dependency vulnerability and provenance checks in CI.
• Review and test dependency updates before modifying the lockfile.
• Use an isolated virtual environment or container with minimum filesystem and network privileges.
• Replace unconstrained installation documentation with installation from the reviewed lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script defines multiple fallback API gateways over plain HTTP while sending the user's TUSHARE token by directly overriding the client's HTTP endpoint. This allows any network observer or active man-in-the-middle to intercept the token and tamper with market data responses, which is especially risky in a financial data skill where users may trust returned data for analysis or decisions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requests access to a sensitive environment variable (TUSHARE_TOKEN) and performs networked operations, but it does not declare explicit tool scope or permission boundaries. In an agent setting, missing activation and capability constraints increases the chance the skill is invoked with broader-than-necessary access, enabling unintended secret use or network actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation claims the skill does not upload tokens to any third party, yet the token is necessarily sent to the StockToday/Tushare gateway to authenticate API requests. This is dangerous because it misleads users and operators about secret handling and trust boundaries, causing them to disclose credentials under false assumptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation section lacks explicit constraints on when not to activate and provides no disambiguation rules for ambiguous requests. Without negative examples or confirmation gates, the agent may over-trigger this networked skill in contexts that did not intend external financial data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language triggers are broad phrases like '最近怎么样' or '快速研究 XX', which can overlap with ordinary conversation and cause unintentional skill activation. In an agent with credentials and network access, accidental invocation can lead to unnecessary external requests, secret use, or disclosure of user financial interests to the remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation tells users to initialize API access with a token but never labels the token as a secret or warns against sharing it in prompts, examples, screenshots, or logs. In LLM-agent contexts, missing secret-handling guidance often leads to users pasting live credentials into conversations and tool arguments, where they may be retained or exposed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes the skill as serving stock, fund, futures, options, bonds, and macro data research workflows. This file also documents APIs for movie box office, cinema revenue, film/TV备案, and Taiwan TMT revenue datasets, which are not clearly justified by the stated purpose of financial market and macro research.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented token self-inspection endpoint explicitly asks for a raw token and says it is '必调用', which encourages users or higher-level agents to pass a sensitive credential into normal tool flow. In an agent environment, that materially increases the risk of credential disclosure through prompts, logs, traces, analytics, error messages, or downstream tool chaining.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A token-check endpoint that accepts the token itself as an input parameter, without any privacy or redaction warning, creates a direct secret-exfiltration hazard. Because the feature is framed as self-check functionality, users may be socially nudged into submitting valid credentials into an analysis surface that is more likely to be logged, echoed, cached, or mishandled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring and usage instructions are entirely in Chinese, which imposes a specific language on users without indicating that alternative languages are supported. This can violate language/locale policy when skills are expected to be accessible without forcing a single language absent user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file-level natural-language instructions and descriptions are entirely in Chinese and present the skill behavior in that language without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly documented as a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section titled '中文自然语言默认口径' establishes a Chinese-language default interpretation policy, but the document does not offer the user a language choice or note that this locale behavior is optional. This can violate language/locale policy when users interact in other languages or expect locale-neutral behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification for tushare uses a lower-bound only constraint, which allows installation of any newer version, including releases with breaking changes or newly introduced vulnerabilities. While this is a supply-chain hygiene issue rather than an immediately exploitable flaw by itself, it reduces build reproducibility and can expose downstream environments to unexpected or unsafe dependency updates.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

tushare>=1.4.0
pandas>=1.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pandas requirement is also unpinned, so environments may install different versions over time, including versions with known defects or security issues. In a data-processing skill like this one, pandas is likely central to runtime behavior, so unbounded upgrades can affect both security posture and reliability.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

tushare>=1.4.0
pandas>=1.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin pandas, and static analysis notes a known advisory affecting some pandas versions, so it is impossible to verify from this file whether deployments may resolve to an affected release. The risk is contextual: this skill is a financial data ingestion and transformation tool, so if it ever processes attacker-controlled serialized content through vulnerable pandas functionality, an affected version could increase exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.