ClawHub
Back to skill

Security audit

Stocki Financial Reader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed financial-data reader that uses a Stocki API key to fetch market data and includes expected setup diagnostics.

Install only if you trust Stocki with your market-data queries and API-key usage. Treat STOCKI_API_KEY like a password, avoid including personal or confidential context in financial queries, and expect the optional setup diagnostics to contact the configured gateway to verify authentication and service reachability.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill requires environment variables, reads local files, and makes network requests, but it does not declare explicit permissions beyond runtime requirements. That weakens sandboxing and user awareness, making it easier for the skill to access secrets and external services without a clear consent boundary. In this context, the presence of an API key and outbound HTTP calls makes undeclared capability use more sensitive than a purely local skill.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented purpose is market-data retrieval, but the skill also performs diagnostics, auth checks, reachability testing, local version reading, and file-integrity verification. Hidden or under-disclosed behavior is a security issue because users may invoke a data skill without realizing it will probe the environment, test credentials, and inspect local files. The mismatch is more concerning here because the skill is explicitly designed to use an API key and external gateway.

Vague Triggers

Medium
Confidence
77% confidence
Finding
Very broad trigger phrases like generic analysis terms can cause the skill to activate on ambiguous everyday requests. Unintended invocation matters because this skill can send authenticated requests to an external service, so a misroute can expose user queries and use credentials when the user did not intend to access the gateway.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill does not clearly warn that it transmits requests plus a bearer authentication header to an external HTTP service. This is a genuine transparency and consent problem: users may not realize their prompts are leaving the local environment, and operators may underestimate the sensitivity of the configured API key and destination host.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
INSTALL.md:27