T09 · Insecure Skill Coding Practices
Error
- Location
scripts/akshare_eval.py:12- Finding
Unrestricted Python Expression Evaluation Enables Arbitrary Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
AKShare
Security checks for vulnerabilities and agentic risk
Overview
The skill is aimed at public financial data, but its helper can run arbitrary Python code on the user's machine.
Install only if you trust the skill author and will ensure expressions passed to the helper are written by a trusted user, not copied from untrusted prompts or market-data text. A safer version would replace --expr/eval with an allowlisted AKShare function dispatcher and pinned dependency versions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/bootstrap_akshare_env.sh:9- Finding
Unpinned Online Dependency Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
eval() call detected
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The script evaluates a user-supplied Python expression with eval() and explicitly exposes full builtins, which enables arbitrary code execution rather than limited AKShare data access. An attacker can invoke builtins such as import to access os/subprocess, read files, run commands, or exfiltrate secrets, making this far more dangerous than the skill’s stated market-data purpose.
- Content
python env = {'ak': ak, 'pd': pd, 'json': json} try: result = eval(args.expr, {'__builtins__': __builtins__}, env) except Exception as e: print(f'EVAL_ERROR: {e}', file=sys.stderr) raise
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to retrieve market and macro-finance data, but instead accepts arbitrary Python expressions, greatly expanding capability beyond the advertised trust boundary. This mismatch increases the chance that higher-level agents or users pass untrusted input into a general-purpose code execution surface, enabling misuse unrelated to AKShare.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script performs arbitrary expression evaluation and network-capable library calls without any confirmation, sandboxing, or user-visible warning, so a single crafted request can trigger dangerous behavior immediately. In an agent skill context, this is more dangerous because tool invocations may be composed automatically from user input, amplifying the risk of prompt-to-code execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L66 instructs the skill to "translate raw columns into plain Chinese when answering in Chinese," while the skill description and scope are centered on Chinese-market data without offering any explicit user language choice. This creates a locale/language policy concern because it biases output toward a specific language rather than making language selection explicit or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The headings and notes in this markdown file are written entirely in Chinese, including usage guidance and warnings, with no indication that users may choose another language. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in.
- Content