ClawHub
Back to skill

Security audit

Quantflow Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed financial data and backtesting helper with normal dependency and network-use cautions, not evidence of hidden or harmful behavior.

Install in an isolated virtual environment, consider pinning and reviewing `akshare` and `akquant` versions before use, and treat generated backtest results as research only rather than trading advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:54
Finding

Unpinned Installation of Third-Party Financial Packages in Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54–55
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- `pip install akshare`
- `pip install akquant`

Technical Analysis

The installation instructions retrieve the latest available releases of akshare and akquant without exact version constraints or integrity hashes. Consequently, the code installed and executed can differ from the version originally reviewed.

Python packages can execute code during installation and whenever imported. If a dependency release, maintainer account, package index, or dependency chain is compromised, following these instructions could introduce attacker-controlled code. The project also does not provide a lock file, hash-verified requirements file, or trusted-index policy to establish a reproducible dependency set.

This finding does not establish that either named package is currently malicious. The risk arises from installing mutable, unaudited package versions without integrity verification.

Attack Path

  1. An attacker compromises a named package, one of its transitive dependencies, its publisher account, or the package index resolution process.
  2. The attacker publishes a malicious or backdoored version that still satisfies the unrestricted installation command.
  3. A user loads the skill and follows its environment setup instructions.
  4. pip resolves and installs the attacker-controlled release.
  5. Malicious code executes during package installation or when the package is imported by the included scripts.
  6. The payload operates with the privileges and environment access of the user running pip or the scripts.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's privileges. Depending on that user's environment, this could expose accessible files, environment variables, f ...[truncated 238 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace unrestricted package names with exact, reviewed versions.
  • Maintain dependencies in a lock file or a hash-verified requirements file.
  • Require hashes, for example by using pip install --require-hashes -r requirements.txt.
  • Pin and review transitive dependencies, not only the two direct dependencies.
  • Configure an approved package index explicitly and disable unintended fallback indexes.
  • Install into an isolated virtual environment or container using an unprivileged account.
  • Run dependency vulnerability and provenance checks in CI before publishing the skill.
  • Establish a controlled process for reviewing and updating pinned versions.

T08 · Insecure Dependencies

Warning
Location
README.md:38
Finding

Unpinned Installation Commands in Project README

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 38–39
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install akshare
pip install akquant

Technical Analysis

The public setup documentation instructs users to install unconstrained versions of two third-party packages. These commands do not verify package hashes, enforce a reviewed version, select a controlled package index, or reproduce a known dependency graph.

Because package installation and import can execute Python code, the effective project behavior is partly determined by whatever releases the package resolver selects at installation time. This creates a supply-chain exposure in which behavior may change after the project itself has been audited.

There is no evidence in the reviewed files that the named packages are currently malicious. The confirmed weakness is the lack of version and integrity controls.

Attack Path

  1. An attacker gains control of a direct package release, a transitive dependency, a publishing account, or package resolution infrastructure.
  2. A compromised release is made available through the index used by pip.
  3. A user follows the README installation commands.
  4. The unrestricted resolver selects and installs the compromised release.
  5. Attacker-controlled code runs during installation or subsequent imports.
  6. The code inherits the permissions and accessible resources of the invoking user.

Impact Assessment

Exploitation could result in arbitrary code execution with the current user's privileges. Potentially affected resources include project files, user-readable files, environment variables, locally stored tokens, and reachable network services. The actual scope depends on the installation account and runtime isolation. The audited project does not itself request elevated privileges.

Remediation
View remediation

Remediation Suggestions

  • Replace the commands with installation from a version-locked dependency manifest.
  • Pin exact versions rather than minimum versions or unconstrained package names.
  • Include cryptographic hashes for all downloaded distributions.
  • Document the approved package index and prevent dependency-confusion fallback behavior.
  • Generate and publish a reproducible lock file covering transitive dependencies.
  • Recommend installation in an unprivileged virtual environment.
  • Scan dependencies for known vulnerabilities and review new releases before updating pins.

T08 · Insecure Dependencies

Warning
Location
references/数据接口.md:39
Finding

Unpinned Akshare Installation in API Reference Documentation

Content
View full analysis

Vulnerability Details

File Location: references/数据接口.md, line 39
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install akshare

Technical Analysis

The API reference provides an unrestricted installation command for akshare. Although the document later states a minimum version requirement, the command does not enforce an exact reviewed release and does not verify artifact integrity. A minimum version would also remain mutable and would not prevent installation of a subsequently compromised release.

Python dependency installation creates a code-execution boundary because packages and their transitive dependencies may execute code during installation and import. Without hashes or a lock file, users cannot verify that they received the same dependency artifacts used during review.

This is a supply-chain hardening deficiency; the audit found no evidence that the referenced package is presently malicious.

Attack Path

  1. An attacker compromises an eligible akshare release, a transitive dependency, its publishing credentials, or package index resolution.
  2. The malicious release remains compatible with the unrestricted installation command.
  3. A user follows the API reference and executes pip install akshare.
  4. pip downloads and installs the compromised artifact.
  5. The payload executes during installation or when a demonstration script imports akshare.
  6. The payload gains access to resources available to the invoking user.

Impact Assessment

Successful exploitation could enable arbitrary code execution under the user's privileges and access to user-readable files, environment variables, project data, and reachable network resources. The potential impact is greater if installation occurs globally, under an administrative account, or outside a sandbox. No direct elevation or persistence behavior was identified in th ...[truncated 16 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the standalone command with installation from a reviewed, exact-version dependency file.
  • Require package hashes and pin all transitive dependencies.
  • Ensure the documented version requirement matches the enforced dependency manifest.
  • Use a trusted package index or an internally controlled artifact repository.
  • Install in an isolated, unprivileged environment.
  • Automate dependency provenance, vulnerability, and integrity checks in CI.
  • Review package updates before modifying the lock file or approved hashes.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明强调的是“中文自然语言驱动的量化金融数据研究技能”，核心应是把自然语言研究请求转换为数据获取与分析流程；AKQuant 回测只是其中一项集成功能。实际代码则几乎完全聚焦于量化交易策略类的定义与回测示例，包含买卖、开平仓、仓位管理、套利、机器学习预测等交易逻辑。虽然与‘量化分析/回测’部分有一定相关性，但缺失了声明中的核心入口和主要功能：自然语言理解、面向 A 股/财务/资金流/新闻/宏观的研究查询、数据导出与研究工作流编排。因此这是明显的描述与行为不一致，且代码的主要目的与声明的主要目的存在实质偏离。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个完整的中文量化金融研究技能，核心应包括理解用户研究意图并执行数据研究与量化分析流程；但给出的代码仅做 akshare 库版本与函数名枚举检查，没有任何自然语言处理、数据查询、研究流程编排、导出或回测逻辑。其主要目的与声明严重不符，因此应判定为明显不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

声明描述的是一个面向用户请求的金融研究技能，核心能力应包括自然语言解析、根据请求选择数据源并执行研究工作流，且还宣称集成 AKQuant 用于回测和量化分析。实际代码并未实现这些能力，而是一个开发/探索性质的脚本：打印 AkShare 版本，按名称前缀列出 API，随后对几个固定接口做简单调用测试。虽然代码涉及金融数据获取，领域上与声明部分重叠，但其主要目的和功能范围与声明明显不符，缺少自然语言到任务流程的转换、导出/分析工作流，以及 AKQuant/回测能力，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The description presents a general-purpose Chinese quant research skill with natural-language-to-workflow conversion across many Chinese-market research scenarios, plus AKQuant-based backtesting. The supplied code is only a demonstration script for a handful of AkShare data-fetching calls and console printing. Its primary behavior is much narrower and materially different from the declared workflow-oriented skill. While macro data is mentioned in the description, the actual implementation lacks the core declared capabilities and instead includes undeclared emphasis on US and Hong Kong market spot data. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明描述的是一个较完整的中文量化投研技能，重点在于理解自然语言研究需求并组织多步数据研究流程，还声称具备AKQuant回测与量化分析能力。实际代码则是一个独立演示脚本，只做若干 AkShare 接口调用并打印结果，功能范围明显更窄，且主题偏向“其他数据类型”采集。虽然其中部分数据类别（指数、宏观、可转债、外汇）与金融研究相关，但代码没有实现声明中的核心交互与分析能力，也没有出现AKQuant相关逻辑。此外，代码包含加密货币/CME比特币期货/持仓报告等内容，这并非声明重点覆盖的研究场景。整体上，代码实际行为与声明用途存在实质性不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The declared description presents a broad Chinese quant research skill that transforms user requests into executable multi-step research workflows across many financial domains and includes AKQuant for backtesting. The provided code is only a simple demonstration script using AkShare to retrieve a stock list and sample stock-related datasets, printing heads of returned tables. Its primary purpose is example data fetching, not natural-language-driven research automation. This is a material description-behavior mismatch because several headline capabilities in the description are absent from the code, and the actual implemented scope is significantly narrower.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README states the skill is '面向中文自然语言' (for Chinese natural language), which imposes a language constraint in the skill description. The file does not mention any user choice, opt-in, or justified region-specific requirement, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger language is very broad and overlaps with ordinary finance conversation, which can cause the skill to activate in situations broader than intended. In an agent environment with network access and data export behavior, over-activation can lead to unnecessary external requests, unintended file creation, or execution of workflows the user did not clearly consent to.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The quick-rule section uses vague phrases like '看走势' and '查财报' without any limiting conditions, making accidental or excessive activation more likely. In context, this is more dangerous because the skill advertises network access, export capabilities, and research workflow execution, so ambiguous activation can expand agent behavior beyond what the user expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This JSON eval file contains only Chinese-language prompt and expected-output text, which indicates the skill is evaluated in a single language without any visible opt-in or alternative locale support. Under the policy rule, forcing a specific language is a natural-language policy concern unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

文件顶部 docstring 明确写的是“宏观经济数据获取示例脚本”，main 函数打印也重复这一定位，但后续 main 中实际调用了获取美股和港股实时行情的函数。这里不是单纯文档不完整，而是文档对脚本意图的表述与实际执行范围相矛盾。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

模块级文档和主输出信息都将该文件定位为“宏观经济数据获取示例脚本”，通常应围绕 CPI、PMI、利率等宏观指标展开。但代码另外实现并调用了美股和港股实时行情抓取，这属于证券行情数据而非宏观经济数据，和该文件声明的用途存在明显语义偏移。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a skill for Chinese natural-language quantitative financial research centered on A股、指数、ETF/基金、财务、估值、资金流、公告新闻、板块概念与宏观数据. This script additionally retrieves crypto spot quotes, CME Bitcoin futures, and Bitcoin position reports, which are materially outside that stated scope and broaden the skill into global cryptocurrency research.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly describes generating local CSV, Parquet, scripts, and charts but does not warn that files will be created or retained locally. This can create privacy, data handling, and storage-consent issues, especially in shared or managed environments where output artifacts may persist unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

类注释在 L434-L435 声称该策略是“突破20日最高价买入、突破10日最低价卖出”，但实际构造参数在 L439 使用的是 entry_period=10、exit_period=5，且后续逻辑按这两个参数执行。这不是简单的省略说明，而是文档对核心交易规则给出了与代码不同的窗口设定。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

L594-L599 的示例注释明确写着“运行双均线策略（使用股票数据）”，而被传入回测的是 L605 的 DualMAFuturesStrategy，该类在 L32 标注为“期货”策略。虽然代码本身可以技术上运行，但注释和策略语义存在明显错位，容易让使用者误判这是面向股票实现的同一策略。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains natural-language instructions, docstrings, comments, and console output exclusively in Chinese. Under the language/locale policy rule, forcing a single language without user opt-in or justification can be a policy violation, especially for a generally reusable demo script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The docstring, comments, and all user-facing print strings are written exclusively in Chinese, which effectively fixes the skill's interaction language. The file does not indicate that language is user-selectable or that the locale restriction is intentional and documented for a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains multiple natural-language strings and comments in Chinese, including the module docstring and all user-facing print messages. Under the policy rule for language or locale constraints, forcing a specific language without opt-in or justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

All user-facing natural-language strings and docstrings in the file are in Chinese, and the script does not provide an opt-in, alternate locale, or documentation explaining that it is intentionally limited to Chinese-speaking users. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This Python file makes outbound data-fetching calls through the akshare library, which are network/HTTP operations covered by the missing-warning rule for code files. Although the script prints success/failure after execution, it does not disclose beforehand that running it will contact external data sources, and main() automatically triggers all fetches in sequence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The manifest enumerates A股、指数、ETF/基金、财务、估值、资金流、公告新闻、板块概念与宏观数据 as representative research areas, but does not mention forex. Adding real-time and historical FX retrieval expands the behavior into another asset class beyond the description's apparent scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.