Ai Quant Trader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:55 AM UTC
• Version: 1.0.0

Overview

This appears to be a finance simulation skill rather than malware, but it needs Review because it can present synthetic trading data as analysis and has unsafe local file and install behavior.

Review carefully before installing. Treat all screening, backtest, strategy-performance, and signal output as simulation unless the publisher replaces random placeholders with validated data sources. Run any dependency installation in an isolated environment, avoid rerunning the registration script where existing backups matter, and do not connect this code to a real broker without adding explicit confirmations, path validation, audit logs, and hard trading limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: simple_fix.py:21

Finding

Unpinned Runtime Installation of Third-Party Packages

Content

View full analysis

Vulnerability Details

File Location: simple_fix.py:21-37
Vulnerability Type: Unsafe dependency installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code

python

def install_dependencies():
    """安装依赖"""
    print("📦 安装必要依赖...")
    
    dependencies = [
        "akshare",
        "pandas",
        "numpy",
        "tqdm"
    ]
    
    for dep in dependencies:
        print(f"  安装 {dep}...")
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", dep, "--quiet"])
            print(f"  ✅ {dep} 安装成功")
        except subprocess.CalledProcessError:
            print(f"  ⚠️  {dep} 安装失败，尝试继续...")

The same unsafe installation practice is recommended in SKILL.md:15-18 and embedded in generated documentation at register_with_openclaw.py:125-128:

bash

pip install akshare pandas numpy

Technical Analysis

The environment-repair utility installs packages from the default pip package index without exact version constraints, integrity hashes, a lock file, or an explicitly approved repository. Package versions and transitive dependencies can therefore change after the Skill has been reviewed.

Python packages may execute installation or build logic, and imported packages execute module initialization code. Consequently, an upstream package compromise, malicious transitive dependency, or unexpectedly changed release could introduce arbitrary code into the environment.

The package names shown are not demonstrated to be malicious; the vulnerability is the mutable and unauthenticated dependency-resolution process.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or the package-distribution account.
2. A malicious package release becomes eligible for normal pip resolution.
3. A user follows the documentation or runs simple_fix.py.
4. The script invokes pip using the current Python interpreter.
5. pip downloads and installs the mutable ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version.
2. Generate and commit a lock file that records transitive dependencies.
3. Require cryptographic hashes, such as through pip install --require-hashes.
4. Configure an explicitly approved package index or internal mirror.
5. Review dependency updates before modifying the lock file.
6. Move package installation out of the general environment-repair script and require explicit user approval.
7. Run installation in an isolated virtual environment with minimal filesystem and network privileges.
8. Add automated dependency vulnerability and provenance scanning.

T09 · Insecure Skill Coding Practices

Error

• Location: strategy_gen.py:119

Finding

Path Traversal Through Unsanitized Strategy Names

Content

View full analysis

Vulnerability Details

File Location: strategy_gen.py:119-133
Vulnerability Type: Path traversal leading to unauthorized JSON file access
Risk Level: High

Vulnerable Code

python

def optimize_strategy(self, strategy_name):
    """优化策略参数"""
    print(f"⚙️ 优化策略: {strategy_name}")
    
    strategy_file = os.path.join(self.strategies_dir, f"{strategy_name}.json")
    
    if not os.path.exists(strategy_file):
        return {
            "success": False,
            "error": f"策略不存在: {strategy_name}"
        }
    
    # 加载策略
    with open(strategy_file, 'r', encoding='utf-8') as f:
        strategy = json.load(f)

The resulting path is later overwritten at strategy_gen.py:159-161:

python

# 保存优化后的策略
with open(strategy_file, 'w', encoding='utf-8') as f:
    json.dump(strategy, f, ensure_ascii=False, indent=2)

A second read primitive exists at strategy_gen.py:199-207:

python

def get_strategy(self, strategy_name):
    """获取策略详情"""
    strategy_file = os.path.join(self.strategies_dir, f"{strategy_name}.json")
    
    if not os.path.exists(strategy_file):
        return None
    
    with open(strategy_file, 'r', encoding='utf-8') as f:
        return json.load(f)

Technical Analysis

strategy_name is directly interpolated into a filesystem path without rejecting directory separators, parent-directory components, absolute paths, or platform-specific path syntax. os.path.join() does not constrain the resulting path to self.strategies_dir.

A value containing traversal sequences such as ../ can resolve outside user_data/strategies. Because the implementation appends .json, the target must have a compatible resulting filename. get_strategy() can disclose parseable JSON outside the intended directory. optimize_strategy() reads and subsequently rewrites an external JSON document if it contains the expected strategy fields.

The command integration in the inspected main.py currently invokes these method ...[truncated 1429 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace user-controlled filenames with server-generated opaque strategy identifiers.
2. If names must be accepted, enforce a strict allowlist such as [A-Za-z0-9_-]+.
3. Reject .., absolute paths, drive prefixes, forward slashes, backslashes, and null characters.
4. Resolve both the strategy root and candidate path before access:

python

root = Path(self.strategies_dir).resolve()
candidate = (root / f"{strategy_name}.json").resolve()

if candidate.parent != root:
    raise ValueError("Invalid strategy name")

5. Open files only after containment validation.
6. Apply the same validation to optimize_strategy(), get_strategy(), and every future strategy file operation.
7. Run the Skill with filesystem permissions limited to its own data directories.
8. Add tests covering traversal sequences, absolute paths, Windows drive paths, encoded separators, and symbolic links.

T09 · Insecure Skill Coding Practices

Warning

• Location: register_with_openclaw.py:34

Finding

Registration Recursively Deletes an Existing Backup Without Confirmation

Content

View full analysis

Vulnerability Details

File Location: register_with_openclaw.py:34-40
Vulnerability Type: Unsafe destructive filesystem operation
Risk Level: Medium

Vulnerable Code

python

# 如果目标目录已存在，先备份
if target_dir.exists():
    backup_dir = target_dir.with_name(f"{target_dir.name}_backup")
    if backup_dir.exists():
        shutil.rmtree(backup_dir)
    shutil.move(target_dir, backup_dir)
    print(f"📦 已备份旧版本到: {backup_dir}")

The destination is hard-coded at register_with_openclaw.py:18-27:

python

# OpenClaw技能目录
openclaw_skills_dir = Path("C:/Users/Administrator/.openclaw/workspace/skills")

if not openclaw_skills_dir.exists():
    print(f"❌ OpenClaw技能目录不存在: {openclaw_skills_dir}")
    return False

# 当前技能目录
current_skill_dir = Path(__file__).parent

# 目标目录
target_dir = openclaw_skills_dir / "ai-quant-trader"

Technical Analysis

When registration is repeated, the code unconditionally invokes shutil.rmtree() on the existing ai-quant-trader_backup directory. It does not request confirmation, create a uniquely named backup, inspect whether the directory contains user data, or provide a rollback mechanism.

Because rmtree() recursively removes the entire directory tree, a previous installation backup and any data stored beneath it are permanently discarded before the current installation is moved into its place.

The path is constructed from hard-coded constants rather than attacker-controlled input, so this is not a demonstrated arbitrary-directory deletion primitive. It is nevertheless an unsafe destructive operation against a predictable user workspace location.

Attack Path

1. A previous registration has created ai-quant-trader_backup.
2. That backup contains an earlier Skill version, configuration, cache, or user-generated data.
3. The current ai-quant-trader target also exists.
4. The user reruns register_with_openclaw.py.
5. The script recursively deletes the existing backup without warning.
6. It moves the ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Never overwrite or recursively delete an existing backup automatically.
2. Create timestamped or UUID-based backup directories.
3. Request explicit confirmation before any recursive deletion.
4. Display the fully resolved deletion path and validate that it is a direct child of the expected Skill directory.
5. Refuse to follow symbolic links during backup and cleanup operations.
6. Add backup-retention controls that default to preserving existing versions.
7. Use atomic staging and replacement so a failed registration can be rolled back.
8. Make the OpenClaw workspace path configurable and validate it rather than hard-coding an administrator profile.
9. Keep mutable user data outside versioned Skill installation directories.

other

Error

• Location: stock_screener.py:96

Finding

Fabricated Financial Metrics and Trading Results Presented as Analysis

Content

View full analysis

Vulnerability Details

File Location: stock_screener.py:96-108
Vulnerability Type: Fabricated financial analytics and nondeterministic trading output
Risk Level: High

Vulnerable Code

The stock screener generates random fundamentals:

python

def get_financial_data(self, symbol):
    """获取财务数据（简化版）"""
    try:
        # 这里需要更复杂的财务数据获取
        # 暂时返回模拟数据
        return {
            'ROE': np.random.uniform(-10, 20),  # 模拟ROE
            'current_ratio': np.random.uniform(0.3, 2.0),  # 流动比率
            'market_cap': np.random.uniform(10, 500) * 100000000,  # 市值（元）
        }
    except:
        # 如果获取失败，返回默认值
        return {
            'ROE': 0,
            'current_ratio': 1.0,
            'market_cap': 10000000000,
        }

Those random values are used as screening criteria at stock_screener.py:210-309, including:

python

financials = self.get_financial_data(symbol)

roe = financials['ROE']
if not (-20 < roe < 15):
    passed = False

current_ratio = financials['current_ratio']
if current_ratio < 0.4:
    passed = False

market_cap = financials['market_cap']
if market_cap >= 100 * 100000000:
    passed = False

Strategy performance is randomly generated at strategy_gen.py:94-101:

python

base_strategy["performance"] = {
    "win_rate": random.uniform(0.55, 0.75),
    "profit_factor": random.uniform(1.2, 2.0),
    "total_return": random.uniform(0.1, 0.3),
    "max_drawdown": random.uniform(0.08, 0.15)
}

Backtest results are randomly generated at strategy_gen.py:209-239:

python

return {
    "success": True,
    "strategy_name": strategy_name,
    "symbol": symbol,
    "period": f"{days}天",
    "results": {
        "total_trades": random.randint(10, 30),
        "winning_trades": random.randint(7, 20),
        "losing_trades": random.randint(3, 10),
        "win_rate": round(random.uniform(0.6, 0.8) * 100, 1),
        "total_return": round(random.uniform(0.15, 0.35) * 100, 1),
        "annual_return": round(r
...[truncated 3205 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove random values from all production screening, strategy, backtest, and automatic-trading paths.
2. Retrieve fundamentals from a documented, validated data source and record source timestamps.
3. Implement deterministic backtesting over actual historical data, including fees, slippage, survivorship bias, and data-adjustment policy.
4. Derive signals from explicit strategy conditions and verified prices rather than random selection.
5. Validate consistency among total, winning, and losing trade counts.
6. Clearly separate demo mode from production mode at the API and user-interface levels.
7. If synthetic data is retained, require explicit opt-in and label every response prominently as synthetic and unsuitable for investment decisions.
8. Block demo-generated results from automatic execution.
9. Add reproducibility tests and retain input datasets, strategy versions, parameters, and calculation logs.
10. Fail closed when required financial data is unavailable instead of supplying plausible-looking defaults.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (45)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

When require_confirmation is set to false, the code directly submits buy and sell orders through the broker without any additional guardrails, user warning, policy check, or runtime authorization step. In the context of an auto-trading skill, this creates a materially dangerous pathway for unintended or manipulated trading activity, especially because the upstream signal generation is mock/random elsewhere in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill can automatically submit a sell order for the entire position when a rule triggers, without any interactive confirmation, secondary authorization, or safety interlock. In a trading context, this is dangerous because malformed rules, stale price inputs, logic errors, or abuse by another component can cause irreversible liquidation and financial loss.

Content

No source excerpt is available for this finding.

exec() call detected

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

Direct exec() call allows arbitrary code execution. An attacker can inject code that runs with the full privileges of the process.

Content

Scanner excerpt · simple_fix.py (reported line 122)May include surrounding context.

python

print(f"工作目录: {os.getcwd()}")
print(f"Python路径: {sys.executable}")
"""
        exec(test_code)
        
        return True

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-start guide is entirely in Chinese and presents Chinese-only commands and examples without offering any language selection, fallback, or note about supported locales. This can exclude or mislead non-Chinese-speaking users, causing incorrect use of the skill or inability to understand trading-related guidance, but it does not by itself create code execution or direct security compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes broad natural-language trigger examples such as generic stock-analysis requests, which can overlap with ordinary conversation and cause unintended activation. In a trading context, accidental invocation can produce unsolicited investment guidance or strategy generation when the user did not explicitly intend to use the skill, increasing the risk of inappropriate financial actions based on mistaken context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrase using the assistant name followed by a generic request is too vague to reliably separate ordinary chat from intentional skill invocation. Because this skill provides financial analysis and trading suggestions, ambiguous triggering is more dangerous than in a low-risk domain: a casual mention could elicit stock recommendations or risk settings without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger "帮我选今天值得关注的股票" is broad natural language that overlaps with ordinary conversational requests, making it easy for the skill to activate unintentionally when a user is just asking for general market commentary. In an agent ecosystem, overly generic invocation phrases can cause inappropriate routing into a finance/trading skill, leading to unsolicited stock screening or advice-like behavior in a higher-risk domain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Examples like "分析一下贵州茅台" and "600519的技术面怎么样" are extremely generic and can match routine user requests that do not clearly indicate consent to invoke a specialized trading-analysis skill. Because the skill operates in a financial decision-support context, accidental activation can expose users to unintended analytical output or strategy-like recommendations without explicit skill selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module and class documentation claim this component is an 'automatic trading executor', which implies executing strategy-driven trading logic. However, the implemented signal detection in check_signals explicitly says it is temporary mock logic and then generates random buy/sell/hold signals, so the documented intent materially differs from the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstrings and user-facing strings are entirely in Chinese, which implies a fixed language/locale experience. There is no indication that the user can opt into another language or that the locale restriction is documented as region-specific.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · check_env.py (reported line 22)May include surrounding context.

python

print("\n检查基本模块:")
for module in ["json", "os", "sys", "datetime", "math"]:
    try:
        __import__(module)
        print(f"  ✅ {module}")
    except:
        print(f"  ❌ {module}")

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · check_env.py (reported line 30)May include surrounding context.

python

print("\n检查基本模块:")
for module in ["json", "os", "sys", "datetime", "math"]:
    try:
        __import__(module)
        print(f"  ✅ {module}")
    except:
        print(f"  ❌ {module}")

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · simple_fix.py (reported line 55)May include surrounding context.

python

print("\n检查基本模块:")
for module in ["json", "os", "sys", "datetime", "math"]:
    try:
        __import__(module)
        print(f"  ✅ {module}")
    except:
        print(f"  ❌ {module}")

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · test_env_simple.py (reported line 25)May include surrounding context.

python

print("\n检查基本模块:")
for module in ["json", "os", "sys", "datetime", "math"]:
    try:
        __import__(module)
        print(f"  ✅ {module}")
    except:
        print(f"  ❌ {module}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code makes outbound requests to AKShare and writes retrieved data to local cache files without any explicit disclosure, consent flow, or control for the caller. In an agent skill context, silent network access and on-disk persistence can violate user expectations, leak sensitive usage patterns such as queried symbols and timestamps, and create compliance or privacy concerns even if the functionality is otherwise legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Historical data retrieval similarly performs undisclosed external requests and persists returned data locally, which is a real transparency and privacy issue in an agent-integrated environment. While not code-execution or injection, it can expose user activity, consume network resources unexpectedly, and leave residual data on disk that other local users or processes may access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The demo explicitly enables automatic trading through a command and presents it as a normal workflow step without any visible warning, confirmation gate, or discussion of financial risk. In a trading assistant context, this can normalize autonomous order execution and lead users to activate potentially unsafe behavior without understanding consequences such as losses, unintended orders, or strategy misconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code enables autonomous trading directly via /自动 启用 without any confirmation step, explicit warning, or consent record that the system may act on the user's behalf. In a trading assistant context, this is safety-relevant because users may unintentionally authorize automated financial actions with real portfolio consequences, especially if downstream modules later connect to live brokerage APIs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description is written as a Chinese-only instruction/context string ('OpenClaw集成模块 - 让AI量化交易助手可以直接在OpenClaw中使用'), and the rest of the user-facing metadata and command descriptions are also exclusively in Chinese. For a general integration module, this imposes a specific language/locale without offering the user any language selection or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The generated skill configuration defines only Chinese display text and slash commands such as '/交易', '/策略', and '/帮助'. This is a natural-language locale restriction presented as the only interface, with no user opt-in, fallback, or justification that the skill is intended solely for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's natural-language strings and documentation are entirely in Chinese, including the module description and class docstring, with no indication that language is configurable or chosen by the user. Under the stated policy, forcing a specific language without opt-in is a locale-policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comment and branch label indicate an ATR stop-loss implementation, which implies use of historical price range or volatility data. Instead, the code explicitly states it is simplified and computes the threshold as a fixed percentage of cost price, which contradicts the documented trading logic rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s user-facing natural-language content is entirely in Chinese, including the module description, status messages, and investment guidance, with no indication that the user can choose another language. This is a locale/language policy concern because the skill effectively imposes a specific language without explicit opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language descriptions and runtime messages in Chinese, starting with the module docstring. The policy explicitly flags language or locale constraints when the skill forces a specific language without offering the user a choice or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script automatically invokes pip to install packages from external package sources at runtime. This creates a supply-chain risk: if a dependency is compromised, typosquatted, or resolved from an unsafe index/configuration, running the script may execute untrusted package installation code on the host.

Content

Scanner excerpt · simple_fix.py (reported line 35)May include surrounding context.

python

for dep in dependencies:
        print(f"  安装 {dep}...")
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", dep, "--quiet"])
            print(f"  ✅ {dep} 安装成功")
        except subprocess.CalledProcessError:
            print(f"  ⚠️  {dep} 安装失败，尝试继续...")

Static analysis

No suspicious patterns detected.