ClawHub
Back to skill

Security audit

AkShare Stock Data Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AkShare-based stock data helper that fetches public market and company data without persistence or hidden local access.

Use this skill if you are comfortable with an agent running Python that imports AkShare and contacts public financial data providers. Review any direct Python snippets before execution, keep any optional provider tokens private, and treat returned data as market data rather than investment advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
整体上，代码与声明的核心方向一致，都是使用 AkShare 获取股票相关数据；不存在明显越权、无关资源访问或恶意/不相关行为。不过声明与实际能力存在较明显的功能清单不一致：声明列出 IPO、大宗交易、估值指标、ESG 评级等，但代码没有实现这些功能；同时代码实际实现了热度排名、盘口报价、涨停池、分笔、分红等声明未明确提及的能力。根据评估标准，这属于描述与实际行为不完全一致，应判定为 mismatch，但属于同一领域内的范围偏差，而非主目的完全不同。

External Transmission

Medium
Category
Data Exfiltration
Content
### `stock_gpzy_pledge_ratio_em`
- **描述**: 东方财富网-数据中心-特色数据-股权质押-上市公司质押比例
- **参数**: date
- **限量**: 单次返回指定交易日的所有历史数据; 其中的交易日需要根据网站提供的为准; 请访问 http://data.eastmoney.com/gpzy/pledgeRatio.aspx 查询具体交易日

### `stock_gpzy_industry_data_em`
- **描述**: 东方财富网-数据中心-特色数据-股权质押-上市公司质押比例-行业数据
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
This markdown file presents all headings, descriptions, and usage details exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language is offered. The file does not indicate that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Static analysis

No suspicious patterns detected.