A股数据获取体系 + 多源智能路由

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 3.0.0

Overview

This finance-data skill is mostly coherent, but its setup instructions use unsafe, mutable dependency installation paths that deserve review before installation.

Review and pin every third-party skill and Python package before installing. Avoid the documented HTTP pip mirror command, avoid global installs and global API-key scope unless necessary, and use an isolated environment with only the credentials needed for market-data access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:361
• Finding: Unpinned Third-Party Skills Are Installed and Subsequently Executed## Vulnerability Details **File Location**: `SKILL.md:361-369`; related instructions at `SKILL.md:54`, `SKILL.md:112-113`, `README.md:151`, and `README.md:161` **Vulnerability Type**: Supply-chain exposure through mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # ftshare announcement data npx openclaw skills install shawn92/ftshare-announcement-data # Wind financial data npx skills add https://gitee.com/wind_info/wind-skills.git --skill wind-mcp-skill -g -y npx skills add https://gitee.com/wind_info/wind-skills.git --skill wind-find-finance-skill -g -y # Other recommended Skills npx openclaw skills install openclaw/skills/tencent-finance npx openclaw skills install sugarforever/01coder-agent-skills/china-stock-analysis ``` The installed Wind component is executed by `data_router.py:250-257`: ```python cli = cls.WIND_SKILL_DIR / "scripts" / "cli.mjs" params_json = json.dumps({"windcode": code, "indexes": indexes}, ensure_ascii=False) cmd = ["node", str(cli), "call", "stock_data", "get_stock_price_indicators", params_json] proc = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, cwd=str(cls.WIND_SKILL_DIR) ) ``` The installed FTShare component is executed by `data_router.py:347-354`: ```python cmd = [ sys.executable, str(cls.FTSHARE_DIR / "run.py"), "stock-announcements-single-stock-all-periods", "--stock-code", stock_code, "--page", str(page), "--page-size", str(page_size) ] proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) ``` ### Technical Analysis The installation commands refer to mutable repository or package identifiers without an immutable commit, reviewed version, checksum, or signature. As a result, the effective code installed by these commands can change after this project has been audited. The Wind command additionally uses global installation and automatic ...[truncated 1835 chars]
• Remediation: ## Remediation Suggestions 1. Pin every external Skill to a reviewed immutable release or full commit hash. 2. Publish expected cryptographic hashes or signatures and verify them before installation. 3. Maintain a lock file or equivalent dependency manifest containing exact versions and integrity metadata. 4. Remove `-y` where practical so users can inspect the source, requested scope, and installation destination. 5. Prefer project-local installation over global installation to reduce the affected scope. 6. Review dependency updates before changing pins, including transitive package changes. 7. Execute external Skills with least privilege and a restricted environment that exposes only required files and credentials. 8. Document the exact trusted versions against which this project was tested.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:250
• Finding: AkShare Installation Uses an Unauthenticated HTTP Package Index## Vulnerability Details **File Location**: `SKILL.md:250` **Vulnerability Type**: Insecure dependency transport and unpinned package installation **Risk Level**: High ### Vulnerable Code ```bash pip install akshare -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host=mirrors.aliyun.com --upgrade ``` ### Technical Analysis The documented command retrieves AkShare through plaintext HTTP rather than authenticated HTTPS. The `--trusted-host` option explicitly permits use of the host without normal TLS certificate authentication. Consequently, pip cannot cryptographically establish that package metadata and artifacts originated from the intended package index. The command also uses an unpinned package name with `--upgrade`. This causes the latest version available from the selected index to be accepted, further increasing supply-chain risk and making installations non-reproducible. A network-positioned attacker could modify the HTTP response, substitute package metadata, or serve a malicious archive. Depending on the selected distribution format and build process, attacker-controlled code could run during package build or later when the installed package is imported. ### Attack Path 1. A user runs the installation command from the deployment guide. 2. The request to the package index travels over unauthenticated plaintext HTTP. 3. An attacker controlling or intercepting the network path responds with modified package metadata or an attacker-controlled AkShare artifact. 4. Because the host is explicitly trusted and no hashes are required, pip accepts the substituted content. 5. The malicious package is installed into the active Python environment. 6. Attacker-controlled code executes during an applicable source-build step or when the package is subsequently imported and used. ### Impact Assessment Successful exploitation can result in arbitrary Python code execution with the privileges of the user running pip or i ...[truncated 471 chars]
• Remediation: ## Remediation Suggestions 1. Replace the HTTP index with an HTTPS endpoint that has valid certificate verification. 2. Remove `--trusted-host`; do not bypass transport authentication. 3. Pin AkShare to a reviewed exact version rather than using an unrestricted upgrade. 4. Record and verify artifact hashes, preferably through a locked requirements file and pip's `--require-hashes` option. 5. Install dependencies inside an isolated virtual environment rather than a shared or system Python environment. 6. Use a trusted internal mirror only if it synchronizes packages securely and provides authenticated HTTPS. 7. Add a documented dependency-review process before updating the pinned version or hashes. A hardened installation pattern should use an authenticated HTTPS index and a hash-locked requirements file, for example: ```bash python -m pip install --require-hashes -r requirements.lock ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Ae1

High

• Category: analysis-evasion

Content

编辑 `data_router.py` 中的 `WATCHLIST` 列表即可自定义你的自选股：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

编辑 `data_router.py` 中的 `WATCHLIST` 列表即可自定义你的自选股：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add ... -g -y` without pinning an exact package/version, which causes code fetched at install time to execute with whatever the latest dependency resolution returns. In a skill-install context, this increases supply-chain risk because a compromised package, tag, or upstream tool behavior change could lead to unexpected code execution and global environment modification.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The command `npx openclaw skills install shawn92/ftshare-announcement-data` references a remote skill install flow without any version pinning or integrity constraint. If the upstream package or referenced skill is altered, users may execute unintended code during installation in their local skill environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill tells users to install and execute tooling via `npx openclaw` without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a newer malicious or compromised package release could be fetched and run at install time, and the document encourages running such commands on a fresh machine where trust is high.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This command uses `npx skills add` to fetch and install a remote skill from a Gitee repository without an immutable version, tag, or commit pin. Because `npx` may resolve and execute the latest available package behavior and the remote repository can change over time, users are exposed to remote code execution through a mutable supply chain.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Like the previous installation step, this `npx skills add` command pulls code from a mutable remote source with no version or commit pinning. In the context of a deployment guide, this is dangerous because users are encouraged to execute it directly, making compromise of the package or upstream repository immediately impactful.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide instructs users to configure a global Wind API key but does not warn about secret handling, least privilege, local exposure, or where the credential will be stored. In practice, users may paste long-lived credentials into shell history or machine-wide config accessible by other processes, leading to credential leakage and unauthorized API use.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: This repeats the unpinned `npx openclaw` installation pattern in the quick deployment section, increasing the chance that users will run it verbatim. Repetition in a setup guide for new machines amplifies the supply-chain risk because it normalizes direct execution of mutable package manager commands.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The deployment step installs a remote Gitee-hosted skill through `npx skills add` without pinning an immutable revision. That means the exact code executed can change over time, and if the tool or repository is compromised, the install path can deliver arbitrary code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This is another mutable remote installation command identical in risk profile to the adjacent one. Since the skill is intended for operational deployment and AI-agent integration, compromise of the installed skill could affect downstream automation and data-handling workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs installing another third-party skill via bare `npx openclaw skills install` without version pinning. Installing directly from mutable package ecosystems is a classic supply-chain weakness, especially when the guide presents it as a normal optional extension step.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: This command introduces the same unpinned install risk for yet another third-party skill. The overall context makes it more dangerous because the document aggregates multiple external dependencies, expanding the attack surface and increasing the chance that one mutable upstream source becomes malicious or compromised.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The header explicitly says '无需额外安装任何依赖，仅使用Python标准库', which states no extra dependencies are needed and only the standard library is used. In practice, the code depends on external components and runtimes: it looks for a Wind skill CLI and executes it with Node, and it also runs another external Python skill via subprocess, so the documentation materially misrepresents runtime behavior and dependencies.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

params_json = json.dumps({"windcode": code, "indexes": indexes}, ensure_ascii=False)
            cmd = ["node", str(cli), "call", "stock_data", "get_stock_price_indicators", params_json]

            proc = subprocess.run(
                cmd, capture_output=True, text=True, timeout=timeout,
                cwd=str(cls.WIND_SKILL_DIR)
            )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--page", str(page),
                "--page-size", str(page_size)
            ]
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

            result.response_time_ms = round((time.time() - start) * 1000)
            stdout = proc.stdout.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: 整个技能说明文档均为中文，未提供其他语言选项，也未说明该技能文档仅面向特定语言用户。按规则，强制单一语言而无用户选择或明确、合理的语言限制说明，属于自然语言层面的语言/locale 策略问题。

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The README provides installation and copy commands that can write into global or user skill directories and perform persistent environment changes, but it does not clearly warn about those side effects. This is dangerous mainly from a safety/transparency perspective because users may execute commands affecting shared agent environments without understanding the scope.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The module description frames the tool as 'A股交易数据获取', which implies an A-share-focused router. However, the code defines and probes non-A-share symbols as well, including U.S. indices and commodity tickers, creating a clear divergence between the stated scope and implemented coverage.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This Python skill’s top-level docstring, usage guidance, comments, and user-facing CLI messages are written in Chinese, which effectively forces a specific language for interaction and interpretation. The file does not offer an English alternative, locale selection, or any user opt-in for the language choice.

Static analysis

No suspicious patterns detected.