中国汽车产销分析可视化

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent China auto dashboard, but it can present generated comparison data as if it came from the stated market source.

Review before installing if you plan to rely on the charts for business, market, or financial decisions. The tool appears locally scoped and not malicious, but its bottom comparison chart can include generated values that are not clearly disclosed as synthetic, and dependency versions are not locked.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 61
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install akshare pandas matplotlib numpy

Technical Analysis

The documented installation command retrieves four packages and their transitive dependencies without specifying reviewed versions, cryptographic hashes, or a lock file. Consequently, users receive whichever package versions the configured Python package index serves at installation time.

Package installation and import can execute package-controlled code. If a package release, maintainer account, package-index response, or transitive dependency is compromised, following the documented installation procedure could introduce attacker-controlled code. The absence of version constraints also creates reproducibility and compatibility risks, although those concerns alone are not security vulnerabilities.

No evidence indicates that the currently named packages are malicious. The risk arises from the unsafe dependency acquisition process rather than a confirmed malicious package.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or an associated release account.
2. The attacker publishes a malicious version to the package index used by the victim.
3. A user follows the installation command from SKILL.md.
4. pip resolves and installs the attacker-controlled release because no approved version or hash is enforced.
5. Malicious code executes during package installation or when the dashboard imports and uses the affected package.

Impact Assessment

Malicious dependency code would ordinarily execute with the privileges of the user running pip or the dashboard. It could access files, environment variables, credentials, network resources, and other data available to that account. If installation is performed ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a dependency lock file containing reviewed, exact versions of all direct and transitive dependencies.

2. Generate and verify cryptographic hashes for every distribution.

3. Install dependencies using a command such as:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure an explicitly trusted package index or an internally controlled package mirror.

5. Run dependency vulnerability and provenance checks in continuous integration.

6. Install and execute the application in an isolated virtual environment or container under a non-privileged account.

7. Establish a controlled update process in which dependency upgrades are reviewed, tested, scanned, and then committed with updated hashes.

other

Warning

• Location: china_auto_dashboard.py:314

Finding

Synthetic Market Values Are Presented as Authoritative Source Data

Content

View full analysis

Vulnerability Details

File Location: china_auto_dashboard.py, lines 314–322
Vulnerability Type: other: Data Integrity Misrepresentation
Risk Level: Medium

Vulnerable Code Snippet:

python

rng = np.random.RandomState(year * 31 + start_month)
prod_vals   = curr_vals
whol_vals   = prod_vals * rng.uniform(0.88, 1.06, n)
retail_vals = prod_vals * rng.uniform(0.82, 1.04, n)

bh = 0.26
ax_bot.barh(y_pos - bh, prod_vals,   height=bh, color=C_PROD,   label=f"{year}年 产量",    zorder=3, linewidth=0)
ax_bot.barh(y_pos,      whol_vals,   height=bh, color=C_WHOL,   label="批发销量",          zorder=3, linewidth=0)
ax_bot.barh(y_pos + bh, retail_vals, height=bh, color=C_RETAIL, label="零售销量",          zorder=3, linewidth=0)

Technical Analysis

The application retrieves only the indicator selected by the user. In the comparison chart, it then assigns that selected series to prod_vals and derives the wholesale and retail series by multiplying it by deterministic pseudo-random factors.

These generated values are labeled as production, wholesale, and retail values. Elsewhere, the report attributes its data to AkShare and CPCA without disclosing that two comparison series are synthetic. If the user selects wholesale or retail data, the selected series is still assigned to prod_vals, so even the production label becomes inaccurate.

A fixed seed makes the generated values reproducible, but it does not make them authentic. This is a data-integrity issue because the visualization can cause generated values to be interpreted as externally sourced market statistics.

Attack Path

1. A user invokes the dashboard for production, wholesale, or retail statistics.
2. The application retrieves one real indicator series from the AkShare API.
3. The selected series is assigned to the production variable regardless of the requested indicator.
4. Two additional series are generated by applying ...[truncated 931 chars]

Remediation

View remediation

Remediation Suggestions

1. Retrieve production, wholesale, and retail data independently from the source API.
2. Align the three datasets by manufacturer, year, month range, scope, and reporting mode before plotting them.
3. Validate that each plotted series corresponds to its displayed label.
4. If a source series is unavailable, omit it or display an explicit “data unavailable” marker rather than generating replacement values.
5. If synthetic demonstration data is an intentional feature, require an explicit demonstration mode and place a conspicuous synthetic-data notice in the chart title, legend, and footer.
6. Add automated tests that verify plotted values exactly match the retrieved source records.
7. Record source metadata and retrieval timestamps so generated reports remain auditable.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The dashboard explicitly labels the bottom chart as a comparison of production, wholesale, and retail values, but two of the three series are generated from pseudo-random multipliers instead of real data. This creates materially false analytical output that could mislead users into making business or investment decisions based on fabricated figures, and the deterministic seeding makes the fake data look intentional and repeatable rather than obviously placeholder data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language content of the skill, including its purpose, usage instructions, and follow-up examples, is presented only in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a language/locale policy violation unless the locale limitation is explicitly justified; this file does not provide such an opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The figure title always claims the report is cumulative YTD, even though the code can silently fall back to single-month data when cumulative retrieval fails. This misrepresents the time scope of the dataset and can cause users to draw incorrect conclusions about market trends and totals.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file includes user-facing natural-language content such as the module docstring, CLI description, help text, and runtime messages only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language or explicit locale constraint is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.