Security audit
Security checks for vulnerabilities and agentic risk
The skill’s financial-data behavior is mostly disclosed, but it needs review because installation uses an unverified remote shell script and the API key can be sent to any configured gateway URL.
Review before installing. Do not run the `curl | bash` installer unless you trust SkillHub and are comfortable executing remote code; prefer an inspectable, version-pinned installer if available. Set `STOCKI_GATEWAY_URL` only to `https://skill.stocki.com.cn` or a trusted local development gateway, avoid remote `http://` URLs, and rotate `STOCKI_API_KEY` if it may have been sent to an untrusted endpoint. Expect your financial queries, symbols, date ranges, and API key to be sent to the configured Stocki service.
INSTALL.md:8Unverified Remote Installer Is Downloaded and Executed Directly
scripts/_http.py:22Bearer API Key Can Be Sent to an Arbitrary or Plaintext Gateway Origin
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
data = json.dumps(body).encode("utf-8")
req = Request(url, data=data, headers=headers, method=method)
try:
with urlopen(req, timeout=timeout) as resp:
raw = resp.read().decode("utf-8")
return json.loads(raw) if raw else {}
except HTTPError as e:
The recommended installation method downloads a remote script and executes it immediately via shell, preventing users from reviewing what will run first. If the server, CDN, DNS, TLS termination, or publisher account is compromised, arbitrary code executes on the user's machine with the user's privileges.
curl -fsSL https://skillhub.cn/install/install.sh | bash
skillhub install stocki-financial-reader
Piping fetched network content directly into bash removes any opportunity for integrity validation or manual inspection and is a classic command-chaining anti-pattern. In the context of an agent skill install guide, this is more dangerous because users are encouraged to grant quick trust to tooling that can modify their environment and install additional components.
curl -fsSL https://skillhub.cn/install/install.sh | bash
skillhub install stocki-financial-reader
The declared description presents this as an institutional-grade financial data access skill covering many datasets and markets. The supplied code chunk does not implement broad market-data retrieval or analysis capabilities; instead, its primary purpose is operational diagnostics for the backend service. It performs four checks: gateway reachability, authenticated quote read for a single sample symbol, and two resolver tests. While these checks touch financial-data endpoints, they are for health verification rather than delivering the described end-user functionality. Therefore the code chunk’s actual behavior is materially different from the declared purpose.
The declared description says this skill is for structured market and financial data access and analysis. However, the code chunk shown is purely an operational 'doctor' script for installation/runtime diagnostics. Its behavior is limited to local environment validation, optional network retrieval of a remote version file, and file integrity checking. Those actions are unrelated to the described end-user financial data capabilities. This is a material description-behavior mismatch because the primary purpose of the code is maintenance/diagnostics rather than financial data services.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- `hk:stock × {financial, indicator, market_cap, valuation}` ✅
- `us:stock × market_cap` ✅; most other us combos are unavailable — pass server `error + warnings` through to the user
<!-- These sections document the upstream API payload contract; raw column keys (e.g. `oper_rev`) appear here intentionally and are not user-visible. -->
<!-- lint:disable rule=canonical-metric -->
## Input schema
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
|---|---|---|
| POST | `$STOCKI_GATEWAY_URL/api/v2/market_metric/get_metrics` | Pull the metric registry (filter by area / asset_type / kind) |
<!-- This file IS the canonical metric mapping source; canonical names below are intentional and request-side only, not user-visible output. -->
<!-- lint:disable rule=canonical-metric -->
## Input schema
The file directs users to install from skillhub.cn and later configures the gateway as skill.stocki.com.cn, which imposes a specific locale/region choice in the skill instructions. There is no user opt-in, alternative locale, or explanation that this skill is region-specific, so this reads as a natural-language locale policy violation.
The skill declares access to environment variables, file reads, and networked HTTP behavior but does not define any explicit tool scope or permission boundary. In an agent ecosystem, this weakens least-privilege controls and makes it harder for hosts or reviewers to constrain what the skill may access, especially since it handles API credentials and remote requests.
The markdown includes a prescribed fail-loud user message entirely in Chinese, which can force a specific language regardless of the user's locale. The policy requires avoiding language or locale constraints unless the skill offers user choice or clearly justifies the restriction.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) consensus_forecast — single stock latest consensus:
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/datareader/read" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"area":"cn","asset_type":"stock","data_type":"consensus_forecast","symbols":["600519"],"start_date":"2026-04-01","end_date":"2026-04-30","extra":{"con_years":[2026]}}'
The trigger vocabulary includes generic phrases such as "分析一下", "综合分析", "analyze X", and "financial context" that can plausibly appear in ordinary conversation or be satisfied by multiple adjacent skills. Although boundary guidance is provided later, the activation phrases themselves are still broad and lack explicit negative examples tied to the trigger list.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) L1 composite analysis — "analyze Moutai":
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/financial_context/cn" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"symbol":"600519","layer":1}'
The instructions require using Chinese labels from field_descriptions and say not to emit raw keys directly, which imposes a language choice in the skill behavior. There is no indication that the user can opt into another language or that the locale restriction is explicitly justified as a region-specific policy.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) Happy path — financial Q4 statement items:
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/datareader/read" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"area":"cn","asset_type":"stock","data_type":"financial","symbols":["600519"],"metrics":["oper_rev","net_profit"],"start_date":"2024-01-01","end_date":"2025-12-31","extra":{"report_type":"Q4"}}'
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- `industry` returns the industry tag per trading day (the label can change across years). For "current industry" → `end_date` = latest trading day, take the last record.
- `share` returns share-structure **change events** (not a daily panel). NA fills are normal.
- `index_member` is a **panel time-series** (one record per constituent per day). CSI 300 over one year ≈ 73K records → **far exceeds `inline_threshold` max 1000, must narrow query**. For "current constituents" only → `start_date` = `end_date` = latest trading day, set `inline_threshold = 400` (300 × 1.33 margin) → `len(data) == total_records == ~300` inline, no truncation. Longer ranges → narrow further or fail-loud per SKILL.md §Inline Threshold.
- `index_member` symbols must carry the exchange suffix (`"000300.SH"` / `"399006.SZ"` / `"HSI.HI"`).
⚠️ **inline_threshold (same body param as price/fundamental)**: pass when expected `total_records > 50` to avoid 50-row truncation. `index_member` single-day on ~300-stock indices (CSI 300 / HSI) → `inline_threshold = 400`; `industry` / `share` single-symbol queries are typically <50 rows so the default suffices. **Full decision rule: SKILL.md §Inline Threshold.**
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- `industry` returns the industry tag per trading day (the label can change across years). For "current industry" → `end_date` = latest trading day, take the last record.
- `share` returns share-structure **change events** (not a daily panel). NA fills are normal.
- `index_member` is a **panel time-series** (one record per constituent per day). CSI 300 over one year ≈ 73K records → **far exceeds `inline_threshold` max 1000, must narrow query**. For "current constituents" only → `start_date` = `end_date` = latest trading day, set `inline_threshold = 400` (300 × 1.33 margin) → `len(data) == total_records == ~300` inline, no truncation. Longer ranges → narrow further or fail-loud per SKILL.md §Inline Threshold.
- `index_member` symbols must carry the exchange suffix (`"000300.SH"` / `"399006.SZ"` / `"HSI.HI"`).
⚠️ **inline_threshold (same body param as price/fundamental)**: pass when expected `total_records > 50` to avoid 50-row truncation. `index_member` single-day on ~300-stock indices (CSI 300 / HSI) → `inline_threshold = 400`; `industry` / `share` single-symbol queries are typically <50 rows so the default suffices. **Full decision rule: SKILL.md §Inline Threshold.**
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) industry — cn single stock:
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/datareader/read" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"area":"cn","asset_type":"stock","data_type":"industry","symbols":["600519"],"start_date":"2024-01-01","end_date":"2026-05-08"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) User asks for "ROE" → look under profitability:
curl -X POST "$STOCKI_GATEWAY_URL/api/v2/market_metric/get_metrics" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"area":"cn","asset_type":"stock","kind":"profitability_and_earnings_quality"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) Happy path — cn single-stock monthly OHLCV:
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/datareader/read" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"area":"cn","asset_type":"stock","data_type":"price","symbols":["600519"],"metrics":["open","high","low","close","volume"],"start_date":"2026-04-01","end_date":"2026-04-30"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(a) Happy path — single stock + fundamentals:
curl -X POST "$STOCKI_GATEWAY_URL/api/v3/quotes/get_latest_quotes" \
-H "Authorization: Bearer $STOCKI_API_KEY" -H "Content-Type: application/json" \
-d '{"assets":[{"symbols":["600519"],"area":"cn","asset_type":"stock"}],"include_fundamentals":true}'
This code performs outbound HTTP requests and sends a bearer token from STOCKI_API_KEY in the Authorization header, and may also transmit JSON request bodies. Although the module docstring describes the helper technically, it does not provide a user-facing warning or disclosure about network transmission of credentials or data within this file.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
The README states the skill is for 'ClawBot (WeChat / Lark / WhatsApp / ...)' end users via OpenClaw agents, which may imply a constrained deployment context. However, this is only a weak potential policy concern because it does not explicitly force a language or locale, so confidence is limited.
The instruction says the agent 'picks EN or CN label based on the user's language,' which imposes a language behavior automatically. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the user is explicitly offered a choice or the constraint is justified.
Detected: suspicious.exposed_secret_literal