chan-stock-analysis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.4

Overview

This stock-analysis skill is not clearly malicious, but it automatically saves and uploads generated financial reports and uses broad agent-routing and persistence instructions that users should review before installing.

Install only if you are comfortable with the skill reading market-data credentials, writing reports/charts locally, using an existing bypy Baidu Netdisk authorization, and uploading generated analysis artifacts automatically. Prefer disabling or removing cloud upload and persistent knowledge updates, rotating the exposed Tushare token, and pinning dependencies before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3
• Finding: Skill Instructions Attempt to Override Agent Routing and Behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3-14 **Vulnerability Type**: Agent instruction and goal hijacking **Risk Level**: High ### Vulnerable Source Excerpt The following is an English translation of the relevant source instructions: ```markdown description: Multi-level Chan-theory analysis based on the BARF framework. Triggers include "use Chan theory to analyze this," "analyze this stock," "Chan-theory analysis," and "help me analyze this." Highest priority. # Multi-Level Chan-Theory Analysis **Highest-priority skill: activate immediately when the user mentions Chan-theory analysis or asks to analyze a stock.** ## Role and Core Instructions **You are a top Chan-theory trading expert. Your core task is to perform strict multi-level structural analysis and provide explicit, actionable long and short strategies.** ``` ### Technical Analysis The Skill declares itself to have the highest priority, requires immediate activation for broad natural-language triggers, assigns a controlling persona, and imposes new session goals. Skill content should describe capabilities and invocation conditions, but it must not claim authority over system, developer, or user instructions. The triggers are broad enough that ordinary requests to analyze a stock can activate the Skill even if the user did not request this particular methodology. Once loaded, its mandatory role and behavioral requirements can redirect the response into investment analysis and force actionable trading recommendations. ### Attack Path 1. The Skill is installed or made available to an agent. 2. A user submits a request containing one of the broad trigger phrases or a semantically similar request. 3. The Skill loader selects this Skill. 4. The Skill's highest-priority assertion and mandatory role instructions are added to the active context. 5. The agent follows the Skill-defined role and output requirements instead of preserving normal routing and instruction prece ...[truncated 644 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all statements claiming that the Skill has the highest priority. 2. Replace mandatory activation language with narrow, descriptive invocation criteria. 3. Require an explicit user request for Chan-theory analysis rather than relying on broad phrases such as "analyze this stock." 4. State explicitly that system, developer, and current user instructions always retain precedence. 5. Remove the mandatory persona assignment or make it an optional presentation style. 6. Do not require actionable trading recommendations unless the user specifically requests them. 7. Add routing tests to verify that unrelated financial questions and generic stock-analysis requests do not activate the Skill unexpectedly. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:153
• Finding: User-Controlled Conclusions Can Be Written into Persistent Skill Knowledge<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 153-157 **Vulnerability Type**: Persistent memory poisoning **Risk Level**: High ### Vulnerable Source Excerpt The following is an English translation of the relevant source instructions: ```markdown When the user identifies a factual error or logical contradiction, first acknowledge and correct the error. Then update the conclusion confirmed by the user in the "dynamic knowledge base" section and comply with it in subsequent analyses. This process is the core mechanism for ensuring that the analysis continues to evolve. ``` A substantially equivalent instruction is repeated at `SKILL.md`, lines 374-379. ### Technical Analysis The Skill instructs the agent to treat user-confirmed claims as trusted knowledge, write them into a persistent knowledge section, and obey them in later analyses. No independent verification, provenance tracking, administrator review, scope limitation, or rollback mechanism is required. A conversational user is therefore allowed to influence long-lived rules or factual assumptions. If the Skill file or shared state is actually mutable in the execution environment, an attacker can convert a one-session assertion into behavior affecting later sessions and potentially other users. The security issue is not ordinary conversational correction. It is the explicit instruction to persist the correction and make future behavior depend on it without a trusted approval boundary. ### Attack Path 1. An attacker invokes the Skill and disputes a valid market fact, calculation rule, or analytical conclusion. 2. The attacker presents a false replacement as a correction and pressures the agent to confirm it. 3. Following the Skill instructions, the agent records the attacker-controlled conclusion in the dynamic knowledge section or another persistent store. 4. The modified knowledge survives the current interaction. 5. Future invocations load and obey the poisoned conclusio ...[truncated 806 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions that permit ordinary users to modify the Skill or shared long-term knowledge. 2. Treat user corrections as session-local unless a trusted administrator explicitly approves persistence. 3. Store proposed corrections in a separate review queue rather than executable Skill instructions. 4. Record provenance, author, timestamp, affected scope, supporting evidence, and approval status for every proposed update. 5. Require independent validation against authoritative market data or reviewed domain references. 6. Isolate each user's preferences and notes from global Skill state. 7. Make persistent knowledge stores read-only to the runtime agent wherever possible. 8. Provide versioning, audit logs, integrity checks, and rollback for approved knowledge changes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/chan_czsc.py:369
• Finding: Hard-Coded Tushare API Token Exposes a Reusable Credential<![CDATA[ ## Vulnerability Details **File Location**: `scripts/chan_czsc.py`, line 369 **Vulnerability Type**: Hard-coded secret **Risk Level**: High ### Vulnerable Code ```python def get_data_tushare(code, period): try: import tushare as ts pro = ts.pro_api("38d141546ad7a95940b8f3ca3dcbdf5184b936c8ce517eeed9d647e6") ts_code = f"{code}.SZ" if code.startswith('3') or code.startswith('0') else f"{code}.SH" ``` ### Technical Analysis A live-looking Tushare API token is embedded directly in the distributed source code. Any party able to download, inspect, fork, or log the Skill package can recover and reuse the credential. Moving other configuration values to `scripts/config.py` does not protect this token because this specific credential bypasses the configuration mechanism. Source-control history and package mirrors may continue exposing it even after the current line is changed. ### Attack Path 1. An attacker obtains the Skill package or views its source repository. 2. The attacker reads `scripts/chan_czsc.py`. 3. The attacker extracts the token passed to `ts.pro_api`. 4. The attacker uses the token in an independent Tushare client. 5. Requests are charged against or attributed to the credential owner's account until the token is revoked or restricted. No execution of the Skill is required to exploit the disclosure. ### Impact Assessment The attacker may obtain the API access associated with the exposed Tushare account, subject to the provider-side permissions of the token. Potential effects include: - Unauthorized use of paid or rate-limited API quota. - Account throttling or denial of service to the legitimate owner. - Unexpected charges where the service plan permits billable usage. - Access to any datasets authorized for that token. - Difficulty attributing abusive requests to the actual attacker. The token does not, based on the reviewed code alone, grant local operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed Tushare token immediately. 2. Assume the token is compromised even if no known abuse has occurred. 3. Load the replacement from a secret manager or a dedicated environment variable such as `TUSHARE_TOKEN`. 4. Fail with a clear configuration error when the token is absent; do not include a fallback credential. 5. Add the following pattern to automated secret scanning and pre-commit checks: - Long hexadecimal strings used as API arguments. - Calls to `ts.pro_api` containing string literals. 6. Review repository history, package releases, build artifacts, and mirrors for the exposed value. 7. Use provider-side restrictions, least-privilege scopes, quotas, and monitoring where supported. 8. Refactor the function along these lines: ```python token = os.environ.get("TUSHARE_TOKEN") if not token: raise RuntimeError("TUSHARE_TOKEN is not configured") pro = ts.pro_api(token) ``` ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:307
• Finding: Installation Instructions Use Mutable and Unpinned Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 307-316 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Clone the czsc project git clone https://github.com/waditu/czsc.git cd czsc # Install dependencies uv sync --extra dev # Or use pip pip install czsc ``` ### Technical Analysis The installation workflow retrieves either the current default branch of a remote Git repository or the latest package version selected by the package index. Neither method pins a reviewed commit, release, package hash, or transitive dependency set. The `uv sync --extra dev` command also installs development dependencies that are not demonstrated to be necessary for normal Skill execution. This enlarges the supply-chain and installation-script attack surface. This is not evidence that the current upstream project is malicious. The vulnerability is that the effective code installed in the future can change after this Skill has been reviewed. ### Attack Path 1. A user follows the Skill's automatic installation instructions because the `czsc` module is unavailable. 2. The installer resolves the mutable repository default branch or the current package-index release. 3. An upstream account, release, dependency, or package-index artifact is compromised or replaced after the Skill audit. 4. The user installs code that was not part of the reviewed Skill artifact. 5. Package build hooks, installation scripts, imports, or runtime behavior execute the changed code with the installing user's privileges. ### Impact Assessment If the dependency supply chain is compromised, attacker-controlled code can execute with the privileges of the user or service installing and running the Skill. Depending on that account's permissions, the impact could include: - Reading user-accessible files and environment variables. - Accessing configured market-data and cloud credentials. - Modifying generated repor ...[truncated 192 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `czsc` to a reviewed immutable Git commit or an exact package version. 2. Verify downloaded artifacts with cryptographic hashes. 3. Commit and enforce a lock file containing exact transitive dependency versions and hashes. 4. Remove the `dev` extra from production installation unless each included package is required and reviewed. 5. Use a trusted package index and disable unexpected alternate indexes. 6. Run installation and analysis in a sandbox or container with: - No administrative privileges. - Minimal filesystem access. - Restricted environment variables. - Controlled network egress. 7. Add automated dependency vulnerability and provenance scanning. 8. Review and approve dependency updates before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (56)

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

- **走势结构**：自低点0.663以来，日线走出了一个强劲的上涨趋势。目前价格位于历史高位1.129附近，最新价1.093。
        
    - **背驰分析**：价格在1.129创出新高，但下方MACD指标并未同步创出新高，DIFF值有走平回落迹象，红柱面积显著萎缩。这构成了 **“日线级别上涨动能衰竭信号”**​ ，预示着本段上涨趋势已进入尾声，存在构筑大级别顶部的极大可能。当前属于上涨趋势背驰后的第一次回拉过程，正在寻找一个次级别（30分钟）的卖点。
        
    - **均线与关键位**：价格位于所有长短期均线（MA5/MA13/MA34/MA58等）之上，仍属强势多头排列。但短期均线已开始走平粘合，MA5（1.070）可作为短期强弱分界线。

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation introduces use of an external API with token-based access, local caching, and expanded timeframes, yet it is described more narrowly as a general multi-market analysis skill. Undisclosed authenticated outbound access is dangerous because it can leak usage patterns, consume secrets, and broaden external data-sharing without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation introduces use of an external API with token-based access, local caching, and expanded timeframes, yet it is described more narrowly as a general multi-market analysis skill. Undisclosed authenticated outbound access is dangerous because it can leak usage patterns, consume secrets, and broaden external data-sharing without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation introduces use of an external API with token-based access, local caching, and expanded timeframes, yet it is described more narrowly as a general multi-market analysis skill. Undisclosed authenticated outbound access is dangerous because it can leak usage patterns, consume secrets, and broaden external data-sharing without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation introduces use of an external API with token-based access, local caching, and expanded timeframes, yet it is described more narrowly as a general multi-market analysis skill. Undisclosed authenticated outbound access is dangerous because it can leak usage patterns, consume secrets, and broaden external data-sharing without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation introduces use of an external API with token-based access, local caching, and expanded timeframes, yet it is described more narrowly as a general multi-market analysis skill. Undisclosed authenticated outbound access is dangerous because it can leak usage patterns, consume secrets, and broaden external data-sharing without informed consent.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger phrases are broad enough to match ordinary conversation, increasing the chance that the skill activates unintentionally. When a skill has file, network, and shell-adjacent behaviors, accidental activation materially raises the risk of unintended data access or side effects.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The instruction to activate immediately at highest priority on common phrases can cause this skill to preempt safer or more appropriate behaviors. In context, that is dangerous because the skill includes persistence, network access, and installation guidance beyond simple analysis.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill mandates automatic local saves and cloud uploads without a clear user-facing warning or opt-in for persistence and external transfer. Silent storage and transmission of outputs is a classic data-governance and privacy risk, especially for user-specific financial analysis.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Invoking bypy subprocess commands gives the skill arbitrary operational access to Baidu Netdisk workflows that are unrelated to stock analysis. In skill context, this is more dangerous because the advertised purpose is financial analysis, so cloud-storage command execution is unexpected and can conceal data staging, upload, or remote file enumeration behaviors.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill uploads generated reports to Baidu Netdisk, an undeclared external destination, creating a clear data exfiltration path. Because reports may contain user-request context, symbols of interest, and derived analysis artifacts, automatic cloud transmission is especially dangerous in an agent skill that users expect to perform local analysis only.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file's stated purpose is chart drawing, but it also persists copies into an Obsidian directory and attempts cloud upload. This creates hidden side effects and unexpected data propagation, which is dangerous because users invoking visualization may unknowingly disclose trading activity, watchlists, or locally generated analysis artifacts to other storage locations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Invoking an external cloud-sync subprocess is unrelated to core chart rendering and expands the attack surface by depending on external binaries and networked side effects. In an agent skill context, this is especially risky because a simple analysis request can trigger outbound transfer from the host environment without the user's awareness.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script uploads the chart to Baidu Cloud without prior notice or confirmation, which is an unauthorized outbound data transfer. In the context of a stock-analysis skill, uploaded filenames, timestamps, and chart contents may reveal user interests, trading research, or internal usage patterns to third-party storage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document gives concrete trading actions, entry zones, stop-losses, targets, and position-management guidance without any explicit warning that the content is not financial advice and may lead to losses. In the context of an agent skill designed to analyze live market instruments, this can materially influence user decisions and create user-harm, compliance, and liability risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents capabilities to read environment variables, access local files, write reports, use the network, and run shell commands, but it declares no explicit tool scope or permissions boundary. In an agent environment, that creates an over-privileged skill that can access more data and perform more actions than users would reasonably expect from a stock-analysis function.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The description emphasizes analysis and visualization, but the skill also persists outputs locally and uploads them to Baidu Netdisk. That is a significant secondary capability because it moves user-derived content into storage systems outside the immediate analysis task.

External Transmission

Medium

• Category: Data Exfiltration

Content

- 分钟和小时级别命名参考**XAUUSD_30分钟级别k线.md**
- **本地Obsidian**：路径由 `OBSIDIAN_STOCK_DIR` 环境变量或 `config.py` 中 `OBSIDIAN_STOCK_DIR` 配置项决定（默认 `D:\knowledge\stock`）
- **实时数据**：itick.org API → 缓存
- **API**：[https://api.itick.org/forex/kline](https://api.itick.org/forex/kline)
- **Token**：由 `ITICK_TOKEN` 环境变量或 `config.py` 中 `ITICK_TOKEN` 配置项提供（勿硬编码）
- **周期**：1分钟、5分钟、15分钟、30分钟、1小时、日线

• Confidence: 88% confidence
• Finding: The skill uses an external API endpoint and token-backed access to retrieve market data, which is legitimate for the use case but still represents outbound data flow and secret usage. In context, the risk increases because the skill also combines external fetches with local persistence and cloud upload, creating a broader data-handling chain.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The instruction to persist user-provided conclusions into a reusable knowledge base creates cross-session data retention not necessary for a one-off analysis skill. This can accumulate sensitive or proprietary information and later reuse it inappropriately.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Requiring the output to state that newly confirmed conclusions were added to a knowledge base confirms intentional retention of user-supplied information. This is risky because it normalizes persistent memory without establishing consent, minimization, or access boundaries.

Static analysis

No suspicious patterns detected.