A股港股股票分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

This is a straightforward stock-analysis skill with disclosed use of market-data packages and a Tushare token, with only routine dependency and documentation caveats.

Install this in an isolated Python environment and prefer installing from a reviewed, pinned requirements or lock file. Only set TUSHARE_TOKEN if you are comfortable using Tushare, and expect the scripts to contact Tushare or AKShare to retrieve stock data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unsafe Package Resolution

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4; SKILL.md:30
Vulnerability Type: Supply-chain exposure through mutable dependency versions
Risk Level: Medium

Vulnerable Code

requirements.txt:1-4:

text

tushare>=1.2.73
akshare>=1.14.0
pandas>=1.3.0
numpy>=1.21.0

SKILL.md:30:

bash

pip install tushare pandas numpy

Technical Analysis

The dependency declarations use lower-bound constraints rather than reviewed, exact versions. They also lack cryptographic hashes. Consequently, future installations can resolve to package releases that were not part of this audit. The installation command in SKILL.md is even less restrictive because it specifies no versions and omits akshare, despite the documented AKShare fallback functionality.

Python packages and their transitive dependencies may execute code during installation or when imported. If an allowed future release, package repository account, distribution artifact, or transitive dependency is compromised, installation can introduce arbitrary code that is absent from the audited repository. This is a supply-chain risk rather than evidence that any currently declared package is malicious.

Attack Path

1. An attacker compromises a future permitted release of tushare, akshare, pandas, numpy, or one of their transitive dependencies.
2. A user follows SKILL.md or installs packages using requirements.txt.
3. The package resolver selects the compromised release because the project permits any version at or above the stated minimum and does not verify artifact hashes.
4. Attacker-controlled code executes during package installation, package initialization, or subsequent import by the scripts.
5. The malicious code operates with the permissions of the user or service running the installation and stock-analysis scripts.

Impact Assessment

Successful exploitation could provide arbitra ...[truncated 425 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound constraints with reviewed exact versions using ==.
2. Generate a lock file containing hashes for all direct and transitive dependencies, for example with pip-compile --generate-hashes.
3. Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
4. Update SKILL.md to install from the reviewed requirements or lock file instead of installing unrestricted package names.
5. Ensure the documented installation includes akshare if fallback support remains part of the advertised functionality.
6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
7. Review, scan, and test dependency updates before regenerating approved pins and hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code is broadly consistent with the Tushare-first, AKShare-fallback portion of the description and does support fundamental analysis data retrieval for A-share and Hong Kong stocks. However, the declared description says the tool supports both basic/fundamental analysis and technical analysis, and mentions obtaining行情/market data as well as financial indicators. This code chunk only retrieves and prints financial indicator/report data; it contains no technical-analysis logic, no computation of technical indicators, and no market quote retrieval in this file. Therefore the behavior is materially narrower than the declared purpose, creating a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broader stock analysis tool with Tushare-first data access, automatic fallback to AKShare, and support for both fundamental and technical analysis. The supplied code chunk only performs technical analysis using daily market data and relies on Tushare-related utilities (init_tushare, get_daily). There is no evidence in this chunk of AKShare fallback logic or any financial/fundamental analysis capability. While the technical-analysis portion is consistent with the description, the actual behavior shown is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different upstream versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases through normal dependency updates or supply-chain compromise.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

tushare>=1.2.73
akshare>=1.14.0
pandas>=1.3.0
numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different upstream versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking releases through normal dependency updates or supply-chain compromise.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

tushare>=1.2.73
akshare>=1.14.0
pandas>=1.3.0
numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is not pinned to an exact version, so deployments may install different pandas releases depending on when and where installation occurs. In a data-analysis skill that relies on external packages, this increases supply-chain and reproducibility risk and makes it harder to ensure a non-vulnerable version is consistently used.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

tushare>=1.2.73
akshare>=1.14.0
pandas>=1.3.0
numpy>=1.21.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because pandas is unpinned, it is impossible to verify from this manifest whether installation will select a release affected by known advisories or a patched one. Even though the cited advisory is disputed and may not be directly exploitable in this skill, the lack of version pinning prevents reliable vulnerability assessment and safe reproduction.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is not pinned to an exact version, so deployments may install different numpy releases depending on resolver behavior and publication timing. This creates avoidable supply-chain risk and can expose the skill to newly introduced vulnerabilities or incompatibilities without any code change in the repository.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

tushare>=1.2.73
akshare>=1.14.0
pandas>=1.3.0
numpy>=1.21.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Because numpy is unpinned, the manifest does not establish whether deployments will receive a vulnerable or patched release despite multiple historical advisories affecting some versions. In this stock-analysis context the package is a standard numerical dependency, so the main danger is supply-chain uncertainty and accidental installation of an unsafe version rather than direct malicious behavior in the skill itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The code reads the TUSHARE_TOKEN environment variable to authenticate with an external data provider, but there is no user-facing notice at that access point about using credentials. While the function is straightforward, this file itself does not disclose that a stored token will be consumed for network-backed API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.