Security audit

股票九剑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed A-share stock analysis tool that fetches public market data, runs local analysis scripts, and optionally writes chart images, with no evidence of credential access, exfiltration, destructive actions, or hidden persistence.

Install only if you are comfortable with the skill sending queried stock codes to third-party public market-data providers and writing optional chart images locally. Treat its buy/sell, position, confidence, and risk outputs as automated analysis, not financial advice; verify with independent sources before making trades.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly invokes local Python scripts that fetch stock and market data, implying network access and executable code behavior, yet no permissions are declared. This creates a transparency and policy-enforcement gap: an agent may run code with broader capabilities than a user expects, reducing oversight and increasing the chance of unintended data access or unsafe execution.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill expands from deterministic stock-code analysis into open-ended searching of latest announcements and news, which materially broadens its data access and behavior beyond the declared workflow. Open-ended external retrieval can introduce prompt injection, untrusted content ingestion, and privacy or compliance issues if the agent follows or summarizes adversarial pages.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The description presents the skill as simple stock analysis but omits that it will automatically fetch external data and execute local Python scripts. This lack of disclosure undermines informed consent and makes the skill more dangerous because users and platforms cannot accurately assess operational risk, data flows, or execution side effects.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The documentation describes a chart-generation tool that returns a PNG path, but it does not clearly warn users that invoking the tool will write files to local disk. In an agent/tooling context, unexpected file creation can create privacy, storage, and operational risks, especially if users assume the tool is read-only or if output paths are later exposed to other tools.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The setup and usage guidance does not prominently warn that the skill fetches market data from external network sources such as akshare-backed providers. In an MCP/agent environment, silent network access can violate user expectations, leak usage metadata or queried stock interests to third parties, and break deployment assumptions in restricted or sensitive environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The CLI emits direct trading recommendations, confidence scores, and risk labels without any visible disclaimer that the output is informational and may influence real financial decisions. In a finance-focused skill, this increases the chance that users over-trust the automation and act on potentially inaccurate signals, creating harm through unsafe decision support.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.12.0 pandas>=1.5.0 numpy>=1.24.0 mplfinance>=0.12.10
Confidence: 94% confidence
Finding: The dependency is specified with only a lower bound, so future installs may resolve to newer versions that have not been tested and could introduce breaking changes or vulnerable transitive packages. While this file does not itself prove compromise, unpinned dependencies weaken build reproducibility and increase supply-chain risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.12.0 pandas>=1.5.0 numpy>=1.24.0 mplfinance>=0.12.10 matplotlib>=3.7.0
Confidence: 94% confidence
Finding: Using a minimum-version constraint for pandas allows installation of any newer release, including versions with undiscovered vulnerabilities or incompatible behavior. This creates a supply-chain and reproducibility risk because deployments may not use the same dependency set over time.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.12.0 pandas>=1.5.0 numpy>=1.24.0 mplfinance>=0.12.10 matplotlib>=3.7.0
Confidence: 94% confidence
Finding: The numpy requirement is not pinned to a single vetted release, so package resolution can drift to newer versions without review. That increases the chance of pulling in a vulnerable or incompatible release and makes builds non-reproducible.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.12.0 pandas>=1.5.0 numpy>=1.24.0 mplfinance>=0.12.10 matplotlib>=3.7.0
Confidence: 94% confidence
Finding: An unpinned mplfinance dependency permits uncontrolled upgrades during installation, which can introduce supply-chain issues or runtime regressions. In security terms, this is a low-severity hardening gap rather than an immediately exploitable code flaw.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pandas>=1.5.0 numpy>=1.24.0 mplfinance>=0.12.10 matplotlib>=3.7.0
Confidence: 94% confidence
Finding: The matplotlib requirement is open-ended above a minimum version, allowing future package versions to be installed without explicit approval. This increases exposure to supply-chain compromise, accidental vulnerable upgrades, and inconsistent environments across installs.

Static analysis

No suspicious patterns detected.