T08 · Insecure Dependencies
Warning
- Location
install.py:8- Finding
Unpinned Third-Party Dependencies Installed into the Active Python Environment
- Content
View full analysis
- Remediation
View remediation
Security audit
stock-analysis
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed A-share market analysis skill with real-time data scripts, but users should understand it can install packages, create hourly scheduled runs, and produce financial recommendations.
Install only in a virtual environment, review the hourly cron command before enabling it, and treat generated stock recommendations as informational rather than trading advice. Avoid running the auxiliary CSV scripts unless you first change the hard-coded Desktop path.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/simple_analysis.py:4- Finding
Fixed Developer-Specific Output Path Can Silently Overwrite an Existing File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad stock-market analysis tool with real-time行情, recommendation logic, preference-aware advice, and automated/scheduled analysis. The supplied code does not implement those capabilities. Instead, it only reads a local CSV file from a hardcoded path, lists sector values from a specific column, and filters them by a few hardcoded keywords. While sector screening is loosely related to the description, the primary behavior is much narrower and lacks the core advertised functions, so this is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code partially matches the description because it does perform A-share real-time market retrieval, sector-level analysis, and a simple preference-based view for technology/baijiu/aerospace-related sectors. However, several declared core capabilities are not implemented. There is no stock recommendation engine beyond listing top gainers with volume ratio filters, no event-driven logic, no short/mid-term investment advice generation, and no scheduling or automation mechanism. The 'user preference' support is also not truly user-driven, since the sectors are fixed in code rather than taken from user input. Therefore, the description overstates the implemented behavior, making this a meaningful description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code partially aligns with the description in that it performs sector-based stock screening and recommendation using preference-related keywords like 科技、航天、白酒. However, the declared description significantly overstates the implemented behavior. There is no real-time data retrieval, no automation/scheduling, and no event-driven analysis or richer investment-advice logic. Additionally, the code reads from a hardcoded local CSV file despite no declared permissions. The primary implemented function is a simple offline filter-and-rank recommendation script, which is narrower than the declared tool capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code partially aligns with the declared purpose in that it performs basic stock recommendation/screening for A-share-related sectors like 科技、航天、白酒. However, the primary implemented behavior is much narrower: a local offline CSV filter with fixed criteria. Several prominent declared capabilities are not represented in the code, especially real-time market retrieval, automatic timed analysis, and event-driven recommendation logic. The hardcoded file path and static keyword list further contradict the description of dynamic user-preference-driven analysis. Therefore this is a material description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
该代码与“股票推荐”这一部分有一定相关性，但整体能力明显弱于且不同于声明描述。它没有获取实时行情，而是读取固定路径的本地CSV；没有做板块筛选，而是通过股票名称包含‘科技/白酒/航天’等关键词进行匹配；没有任何自动定时触发逻辑；也没有接收或处理用户投资偏好，偏好词仅为预设常量。此外，代码只依据量比和涨跌幅输出列表，并未提供事件驱动分析或中短线投资建议。因此声明与实际行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The code partially matches the stated purpose because it does retrieve A-share market data and perform basic sector-based screening aligned with themes like tech, aerospace, and liquor. However, the description overstates the implemented functionality: there is no scheduling, no event-driven analysis, and no meaningful recommendation engine beyond basic filters. In addition, the script performs a local file export to a specific desktop path, which is an undeclared capability/resource use. Therefore the declared description does not accurately represent the actual behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown content, headings, commands, and operational guidance are consistently presented in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when the skill offers a language choice or clearly justifies the limitation, neither of which is stated here.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly instructs the agent to execute shell commands and create cron jobs, but it declares no explicit tool scope or permissions. This increases the chance of over-broad tool access and makes it harder for users or the platform to understand that command execution and persistent automation will occur.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger examples are broad natural-language phrases like general requests for analysis or recommendations, which can cause the skill to activate unexpectedly. In this skill, unintended invocation is more dangerous because activation can lead to shell execution and potentially setup of recurring cron tasks, creating side effects beyond simple read-only assistance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs creation of recurring cron jobs and even provides ready-to-run commands, but it does not prominently warn that this establishes persistent automated future actions. This can surprise users, lead to repeated background executions, consume resources, and repeatedly send prompts or perform analysis without fresh user review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The config uses Chinese text for the default user name, investment sectors, risk level, and style, and sets the timezone to Asia/Shanghai. This imposes a specific language/locale in a general configuration file without any visible opt-in or documented justification, which matches the policy-violation category for forced language or locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains user-facing strings and instructional text entirely in Chinese, including the script description, status messages, warnings, and usage instructions. The file does not indicate that Chinese is optional or region-specific, so it effectively imposes a specific language on users without opt-in.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python """安装依赖包""" print("[安装] 安装依赖包...") try: subprocess.run([sys.executable, "-m", "pip", "install", "akshare", "pandas"], check=True) print("[成功] 依赖包安装成功") except subprocess.CalledProcessError as e: print(f"[错误] 依赖包安装失败: {e}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script emits concrete stock recommendations and trading guidance such as '推荐标的', '分批建仓', and a stop-loss rule without any disclaimer, suitability checks, or indication that the output is informational only. In the context of an automated stock-analysis skill, this can unduly influence financial decisions and create user-harm, compliance, and trust risks if users treat the output as actionable advice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code uses Chinese-only natural-language strings throughout the docstring and all user-facing output, which imposes a specific language/locale without any opt-in or configuration mechanism. The policy for natural-language violations applies to all file types, including code string literals, so this is a language-policy concern rather than a functional issue.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a stock-analysis tool that supports real-time quote retrieval, sector screening, stock recommendation, and automatic scheduled analysis. This file only reads a fixed local CSV path and prints simple recommendations from static data, with no real-time data retrieval, scheduling, or event-driven analysis behavior present.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's natural-language interface, labels, and guidance are entirely in Chinese, including the title, prompts, and risk messaging. This creates a language/locale policy issue because the skill does not provide any user opt-in, fallback language, or explanation that it is intentionally region-specific.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly provides a cron command that installs an hourly scheduled task in an isolated agent session, but it does not clearly warn that this creates persistent recurring execution. In an agent skill context, unattended periodic runs can surprise users, consume resources, and repeatedly access external market data or generate outputs without ongoing user awareness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The keyword list is fixed to Chinese terms, which imposes a specific language/locale assumption in the skill behavior. There is no visible opt-in, configuration, or documentation in this file indicating that the script is intentionally limited to Chinese-language data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language strings throughout the script are fixed in Chinese, including the title, report sections, and advice text. Under the policy, forcing a specific language without user opt-in or documented justification is a locale/language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script presents headings, selection criteria, and domain keywords entirely in Chinese, and the filtering logic depends on Chinese sector names. This imposes a specific language/locale on users without any opt-in or explanation that the skill is intended only for a Chinese-market context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code hard-codes Chinese field names and sector keywords such as "所属行业", "科技", and "白酒" as required inputs for its recommendation logic. That creates a locale-specific behavior without any user opt-in or documented language choice, which matches the language/locale policy concern for natural-language handling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The keyword list is fixed to Chinese terms such as '科技', '半导体', and '白酒', which constrains the script's behavior to a specific language context. The file does not indicate that this locale restriction is optional, user-selected, or justified as a region-specific tool.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes market data directly to a hard-coded desktop path on a specific user's machine without checking consent, existence, or safety of the destination. This can cause unintended local file creation, overwrite issues, privacy concerns, and portability problems when the skill is run in different environments or under another account.
- Content