全球股市技术分析报告

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.0

Overview

This is a disclosed A-share stock analysis skill that fetches public market data and formats a Chinese technical report, with no evidence of credential access, persistence, or hidden execution.

Before installing, understand that this skill retrieves public stock data from Eastmoney and may produce Chinese-language technical reports. Treat its output as informational only, especially because some quote API calls use unencrypted HTTP and could be inaccurate if tampered with or unavailable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Unencrypted HTTP Requests Permit Financial Market Data Tampering<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-40 **Vulnerability Type**: Cleartext transport of integrity-sensitive financial data **Risk Level**: Medium ### Vulnerable Code ```text http://push2.eastmoney.com/api/qt/stock/get?secid=0.{代码}&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f170,f171 ``` The same workflow also retrieves market-index data through HTTP: ```text http://push2.eastmoney.com/api/qt/stock/get?secid=1.000001&fields=f43,f57,f58,f60 http://push2.eastmoney.com/api/qt/stock/get?secid=0.399001&fields=f43,f57,f58,f60 ``` ### Technical Analysis The skill instructs the agent to retrieve stock and market-index data over unencrypted HTTP. HTTP provides neither transport confidentiality nor cryptographic server authentication and integrity. An attacker capable of observing or modifying the network path could intercept the requests and replace the API responses. The returned values are subsequently used to generate financial analysis, including prices, percentage movements, trading ranges, and market comparisons. Consequently, forged API responses could be treated as legitimate market data and incorporated into the final report. The affected API requests appear to contain only public market identifiers and do not transmit credentials or private user information. The primary concern is therefore response integrity rather than disclosure of sensitive information. ### Attack Path 1. A user invokes the stock-analysis skill. 2. The agent issues an HTTP request to `push2.eastmoney.com`. 3. An attacker controlling or monitoring an intermediary network component intercepts the cleartext connection. 4. The attacker modifies the response to supply fabricated stock prices, index values, or percentage changes. 5. The skill parses the manipulated values as authoritative market data. 6. The generated report presents inaccurate support levels, market comparisons, or trend conclusions. Exploitation requires a network-positioned attack ...[truncated 733 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `http://push2.eastmoney.com/` endpoint with its verified HTTPS equivalent: ```text https://push2.eastmoney.com/api/qt/stock/get?secid=0.{code}&fields=... ``` 2. Reject redirects that downgrade an HTTPS request to HTTP. 3. Require successful TLS certificate and hostname validation. 4. Validate the response schema, expected field types, security identifier, and stock name before using returned values. 5. Apply reasonable bounds and consistency checks to prices, percentage changes, and trading ranges. 6. Cross-check important values against the HTTPS Eastmoney browser page or another trusted HTTPS source. 7. If secure retrieval or validation fails, mark the relevant data as unavailable rather than generating conclusions from unverified values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: a-stock-technical-analysis/SKILL.md:29
• Finding: Duplicated Skill Definition Uses Unencrypted Financial API Requests<![CDATA[ ## Vulnerability Details **File Location**: `a-stock-technical-analysis/SKILL.md`, lines 29-40 **Vulnerability Type**: Cleartext transport of integrity-sensitive financial data **Risk Level**: Medium ### Vulnerable Code ```text http://push2.eastmoney.com/api/qt/stock/get?secid=0.{代码}&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f170,f171 ``` The duplicated skill definition also retrieves market-index data through HTTP: ```text http://push2.eastmoney.com/api/qt/stock/get?secid=1.000001&fields=f43,f57,f58,f60 http://push2.eastmoney.com/api/qt/stock/get?secid=0.399001&fields=f43,f57,f58,f60 ``` ### Technical Analysis This file duplicates the insecure retrieval instructions found in the root skill definition. The API endpoints use HTTP rather than HTTPS, so the authenticity and integrity of API responses are not cryptographically protected. A network-positioned attacker could alter the response body while it is in transit. Because the skill consumes this data when creating its report, manipulated values may influence price-trend descriptions, market-strength comparisons, volume analysis, and inferred support or resistance levels. The requests only expose public stock or index identifiers. No evidence of credentials, authentication tokens, or private user data being transmitted was found. ### Attack Path 1. The nested skill definition is invoked to analyze an A-share stock. 2. The agent retrieves stock or index information from an HTTP endpoint. 3. A network-positioned attacker intercepts and modifies the cleartext response. 4. Fabricated market values are returned to the agent. 5. The skill treats those values as legitimate input and incorporates them into its analysis. 6. The user receives a report containing attacker-influenced financial conclusions. The attack depends on the ability to intercept or manipulate network traffic. This vulnerability does not by itself allow execution of commands on the host. ### Impact Assessment The attacker can ...[truncated 433 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all Eastmoney HTTP endpoints with verified HTTPS endpoints. 2. Prevent protocol downgrade by refusing redirects from HTTPS to HTTP. 3. Enforce TLS certificate and hostname verification. 4. Validate returned identifiers, fields, data types, and plausible value ranges. 5. Compare high-impact values against the HTTPS browser snapshot or an independent trusted source. 6. Treat failed or unverifiable retrievals as unavailable data and clearly disclose the limitation. 7. Keep duplicated skill definitions synchronized so that the insecure endpoints cannot remain in one copy after remediation. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description activates on very broad user intents such as generating stock analysis reports, querying A-share quotes, or analyzing price trends, without clear constraints on when the skill should or should not run. This can cause over-triggering in unrelated financial conversations, leading the agent to fetch external data or produce market analysis unexpectedly, which increases the risk of unintended tool use and confusing or unsafe financial guidance.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The entire report template is written in Chinese and provides no indication that the user can choose another language or locale. This can violate a language/locale policy when a skill is expected to adapt to user preference unless the locale restriction is explicitly documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This markdown template is entirely written as a fixed Chinese report format, which implies the skill will generate output in a specific language by default. Under the policy rule, a forced language or locale without explicit user opt-in can be a natural-language policy violation unless the regional constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.