Security audit

A股数据获取体系 + 多源智能路由

Security checks for vulnerabilities and agentic risk

Overview

This finance-data skill is mostly coherent, but its setup instructions use unsafe, mutable dependency installation paths that deserve review before installation.

Review and pin every third-party skill and Python package before installing. Avoid the documented HTTP pip mirror command, avoid global installs and global API-key scope unless necessary, and use an isolated environment with only the credentials needed for market-data access.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:361
Finding: Unpinned Third-Party Skills Are Installed and Subsequently Executed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:361-369; related instructions at SKILL.md:54, SKILL.md:112-113, README.md:151, and README.md:161
Vulnerability Type: Supply-chain exposure through mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
# ftshare announcement data npx openclaw skills install shawn92/ftshare-announcement-data # Wind financial data npx skills add https://gitee.com/wind_info/wind-skills.git --skill wind-mcp-skill -g -y npx skills add https://gitee.com/wind_info/wind-skills.git --skill wind-find-finance-skill -g -y # Other recommended Skills npx openclaw skills install openclaw/skills/tencent-finance npx openclaw skills install sugarforever/01coder-agent-skills/china-stock-analysis

The installed Wind component is executed by data_router.py:250-257:

python
cli = cls.WIND_SKILL_DIR / "scripts" / "cli.mjs" params_json = json.dumps({"windcode": code, "indexes": indexes}, ensure_ascii=False) cmd = ["node", str(cli), "call", "stock_data", "get_stock_price_indicators", params_json] proc = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, cwd=str(cls.WIND_SKILL_DIR) )

The installed FTShare component is executed by data_router.py:347-354:

python
cmd = [ sys.executable, str(cls.FTSHARE_DIR / "run.py"), "stock-announcements-single-stock-all-periods", "--stock-code", stock_code, "--page", str(page), "--page-size", str(page_size) ] proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)

Technical Analysis

The installation commands refer to mutable repository or package identifiers without an immutable commit, reviewed version, checksum, or signature. As a result, the effective code installed by these commands can change after this project has been audited.

The Wind command additionally uses global installation and automatic ...[truncated 1835 chars]
Remediation: View remediation
Remediation Suggestions

Pin every external Skill to a reviewed immutable release or full commit hash.

Publish expected cryptographic hashes or signatures and verify them before installation.

Maintain a lock file or equivalent dependency manifest containing exact versions and integrity metadata.

Remove -y where practical so users can inspect the source, requested scope, and installation destination.

Prefer project-local installation over global installation to reduce the affected scope.

Review dependency updates before changing pins, including transitive package changes.

Execute external Skills with least privilege and a restricted environment that exposes only required files and credentials.

Document the exact trusted versions against which this project was tested.

T08 · Insecure Dependencies

Error

Location: SKILL.md:250
Finding: AkShare Installation Uses an Unauthenticated HTTP Package Index
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:250
Vulnerability Type: Insecure dependency transport and unpinned package installation
Risk Level: High

Vulnerable Code

bash
pip install akshare -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host=mirrors.aliyun.com --upgrade

Technical Analysis

The documented command retrieves AkShare through plaintext HTTP rather than authenticated HTTPS. The --trusted-host option explicitly permits use of the host without normal TLS certificate authentication. Consequently, pip cannot cryptographically establish that package metadata and artifacts originated from the intended package index.

The command also uses an unpinned package name with --upgrade. This causes the latest version available from the selected index to be accepted, further increasing supply-chain risk and making installations non-reproducible.

A network-positioned attacker could modify the HTTP response, substitute package metadata, or serve a malicious archive. Depending on the selected distribution format and build process, attacker-controlled code could run during package build or later when the installed package is imported.

Attack Path

A user runs the installation command from the deployment guide.

The request to the package index travels over unauthenticated plaintext HTTP.

An attacker controlling or intercepting the network path responds with modified package metadata or an attacker-controlled AkShare artifact.

Because the host is explicitly trusted and no hashes are required, pip accepts the substituted content.

The malicious package is installed into the active Python environment.

Attacker-controlled code executes during an applicable source-build step or when the package is subsequently imported and used.

Impact Assessment

Successful exploitation can result in arbitrary Python code execution with the privileges of the user running pip or i ...[truncated 471 chars]
Remediation: View remediation
Remediation Suggestions

Replace the HTTP index with an HTTPS endpoint that has valid certificate verification.

Remove --trusted-host; do not bypass transport authentication.

Pin AkShare to a reviewed exact version rather than using an unrestricted upgrade.

Record and verify artifact hashes, preferably through a locked requirements file and pip's --require-hashes option.

Install dependencies inside an isolated virtual environment rather than a shared or system Python environment.

Use a trusted internal mirror only if it synchronizes packages securely and provides authenticated HTTPS.

Add a documented dependency-review process before updating the pinned version or hashes.

A hardened installation pattern should use an authenticated HTTPS index and a hash-locked requirements file, for example:

bash
python -m pip install --require-hashes -r requirements.lock

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.
md
编辑 `data_router.py` 中的 `WATCHLIST` 列表即可自定义你的自选股：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.
md
编辑 `data_router.py` 中的 `WATCHLIST` 列表即可自定义你的自选股：

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add ... -g -y without pinning an exact package/version, which causes code fetched at install time to execute with whatever the latest dependency resolution returns. In a skill-install context, this increases supply-chain risk because a compromised package, tag, or upstream tool behavior change could lead to unexpected code execution and global environment modification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The command npx openclaw skills install shawn92/ftshare-announcement-data references a remote skill install flow without any version pinning or integrity constraint. If the upstream package or referenced skill is altered, users may execute unintended code during installation in their local skill environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill tells users to install and execute tooling via npx openclaw without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a newer malicious or compromised package release could be fetched and run at install time, and the document encourages running such commands on a fresh machine where trust is high.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command uses npx skills add to fetch and install a remote skill from a Gitee repository without an immutable version, tag, or commit pin. Because npx may resolve and execute the latest available package behavior and the remote repository can change over time, users are exposed to remote code execution through a mutable supply chain.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Like the previous installation step, this npx skills add command pulls code from a mutable remote source with no version or commit pinning. In the context of a deployment guide, this is dangerous because users are encouraged to execute it directly, making compromise of the package or upstream repository immediately impactful.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide instructs users to configure a global Wind API key but does not warn about secret handling, least privilege, local exposure, or where the credential will be stored. In practice, users may paste long-lived credentials into shell history or machine-wide config accessible by other processes, leading to credential leakage and unauthorized API use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This repeats the unpinned npx openclaw installation pattern in the quick deployment section, increasing the chance that users will run it verbatim. Repetition in a setup guide for new machines amplifies the supply-chain risk because it normalizes direct execution of mutable package manager commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The deployment step installs a remote Gitee-hosted skill through npx skills add without pinning an immutable revision. That means the exact code executed can change over time, and if the tool or repository is compromised, the install path can deliver arbitrary code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This is another mutable remote installation command identical in risk profile to the adjacent one. Since the skill is intended for operational deployment and AI-agent integration, compromise of the installed skill could affect downstream automation and data-handling workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs installing another third-party skill via bare npx openclaw skills install without version pinning. Installing directly from mutable package ecosystems is a classic supply-chain weakness, especially when the guide presents it as a normal optional extension step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This command introduces the same unpinned install risk for yet another third-party skill. The overall context makes it more dangerous because the document aggregates multiple external dependencies, expanding the attack surface and increasing the chance that one mutable upstream source becomes malicious or compromised.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The header explicitly says '无需额外安装任何依赖，仅使用Python标准库', which states no extra dependencies are needed and only the standard library is used. In practice, the code depends on external components and runtimes: it looks for a Wind skill CLI and executes it with Node, and it also runs another external Python skill via subprocess, so the documentation materially misrepresents runtime behavior and dependencies.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · data_router.py (reported line 254)May include surrounding context.
python
params_json = json.dumps({"windcode": code, "indexes": indexes}, ensure_ascii=False) cmd = ["node", str(cli), "call", "stock_data", "get_stock_price_indicators", params_json] proc = subprocess.run( cmd, capture_output=True, text=True, timeout=timeout, cwd=str(cls.WIND_SKILL_DIR) )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · data_router.py (reported line 354)May include surrounding context.
python
"--page", str(page), "--page-size", str(page_size) ] proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) result.response_time_ms = round((time.time() - start) * 1000) stdout = proc.stdout.strip()

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 整个技能说明文档均为中文，未提供其他语言选项，也未说明该技能文档仅面向特定语言用户。按规则，强制单一语言而无用户选择或明确、合理的语言限制说明，属于自然语言层面的语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README provides installation and copy commands that can write into global or user skill directories and perform persistent environment changes, but it does not clearly warn about those side effects. This is dangerous mainly from a safety/transparency perspective because users may execute commands affecting shared agent environments without understanding the scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The module description frames the tool as 'A股交易数据获取', which implies an A-share-focused router. However, the code defines and probes non-A-share symbols as well, including U.S. indices and commodity tickers, creating a clear divergence between the stated scope and implemented coverage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This Python skill’s top-level docstring, usage guidance, comments, and user-facing CLI messages are written in Chinese, which effectively forces a specific language for interaction and interpretation. The file does not offer an English alternative, locale selection, or any user opt-in for the language choice.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Ae1

Ae1

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Rp1

Rp1

Rp1

Intent-Code Divergence

subprocess module call

subprocess module call

Natural-Language Policy Violations

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations