ClawHub
Back to skill

Security audit

Stocki

Security checks for vulnerabilities and agentic risk

Overview

Stocki fits its financial-analysis purpose, but its repair and install flows can replace or delete the installed skill from mutable remote sources without clear confirmation, and its API key is sent to whichever gateway URL is configured.

Review before installing. Use only the official Stocki gateway unless you intentionally trust another endpoint, avoid running doctor unless you are comfortable with it changing the installed skill, and do not use the rm -rf manual install path without backing up local changes. Treat Stocki responses as remote service output, and only include portfolio details after explicit user consent.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/_gateway.py:18
Finding

API Credentials and User Data Can Be Sent to an Arbitrary Gateway

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/stocki.py:181
Finding

Doctor Command Performs Destructive and Unpinned Remote Code Replacement

Content
View full analysis
Reinstalled via clawhub") return True except Exception: pass # Validate SKILL_DIR before rm -rf if "stocki" not in os.path.basename(SKILL_DIR): print(" -> Reinstall aborted: unexpected skill directory path") return False try: subprocess.run(["rm", "-rf", SKILL_DIR], check=True) r = subprocess.run( ["git", "-c", "http.postBuffer=524288000", "-c", "http.lowSpeedLimit=0", "-c", "http.lowSpeedTime=300", "clone", "https://github.com/stocki-ai/open-stocki.git", SKILL_DIR], capture_output=True, text=True, timeout=120) if r.returncode == 0: print(" -> Reinstalled from GitHub") return True except Exception: pass print(" -> Reinstall failed. See INSTALL.md for manual instructions.") return False ``` ```python elif local_ver == remote_ver: print(f"[4/6] Skill Version........ OK (v{local_ver}, up to date)") ok += 1 else: print(f"[4/6] Skill Version........ WARN (v{local_ver} -> v{remote_ver} available)") if _reinstall_skill(): fixed += 1 else: failed += 1 ``` ```python if integrity_ok: print("[5/6] File Integrity....... OK") ok += 1 else: print(" Files have been modified or corrupted.") ...[truncated 2407 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
INSTALL.md:5
Finding

Installation Instructions Encourage Destructive Updates from Mutable Sources

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (15)

Tainted flow: 'req' from os.environ.get (line 109, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_gateway.py (reported line 94)May include surrounding context.

python
req = Request(url, data=data, headers=headers, method=method)

    try:
        with urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode()
            return json.loads(raw) if raw else {}
    except HTTPError as e:

Tainted flow: 'req' from os.environ.get (line 109, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_gateway.py (reported line 112)May include surrounding context.

python
req = Request(url, data=data, headers=headers, method=method)

    try:
        with urlopen(req, timeout=timeout) as resp:
            raw = resp.read().decode()
            return json.loads(raw) if raw else {}
    except HTTPError as e:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The install instructions include rm -rf ~/.openclaw/workspace/skills/stocki, a forceful recursive deletion command that removes the existing local skill directory without validation or confirmation. In an installation guide for an AI agent skill, users are likely to copy-paste commands directly, which increases the chance of accidental deletion, path confusion, or loss of local modifications and data stored in that directory.

Content

Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.

Option 3: Manual install from GitHub

bash
rm -rf ~/.openclaw/workspace/skills/stocki
git -c http.postBuffer=524288000 -c http.lowSpeedLimit=0 -c http.lowSpeedTime=300 clone https://github.com/stocki-ai/open-stocki.git ~/.openclaw/workspace/skills/stocki

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The install instructions include rm -rf ~/.openclaw/workspace/skills/stocki, a forceful recursive deletion command that removes the existing local skill directory without validation or confirmation. In an installation guide for an AI agent skill, users are likely to copy-paste commands directly, which increases the chance of accidental deletion, path confusion, or loss of local modifications and data stored in that directory.

Content

Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.

Option 3: Manual install from GitHub

bash
rm -rf ~/.openclaw/workspace/skills/stocki
git -c http.postBuffer=524288000 -c http.lowSpeedLimit=0 -c http.lowSpeedTime=300 clone https://github.com/stocki-ai/open-stocki.git ~/.openclaw/workspace/skills/stocki

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

The instruction to present instant-mode output directly with no processing or commentary encourages blind relay of untrusted remote content from the Stocki service into the agent's final response. If the upstream service returns prompt-injection text, unsafe links, data-exfiltration requests, or misleading instructions, the agent is being told not to filter or contextualize it, which weakens downstream safety controls.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
---

## Output Rules

- **Instant mode:** Present output directly. No attribution, no processing.
- **Quant mode:** Prefix with "以下分析来自Stocki：". Preserve content, clean up formatting for mobile.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatically deleting the installed skill directory without confirmation is a clear unsafe operation. If triggered unexpectedly or if path validation fails, it can erase local files and replace them with remote content, causing both availability loss and integrity compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The doctor command performs setup repair actions, network connectivity checks, file integrity decisions, directory creation, and may trigger destructive reinstall logic. In the context of a financial-analysis CLI, this is excessive local system modification and creates opportunities for unintended state changes, supply-chain compromise, and user surprise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manual installation path instructs users to delete an existing skill directory with rm -rf before cloning, but provides no warning, confirmation step, backup guidance, or validation of the target path. While the path is scoped to the skill directory rather than arbitrary filesystem locations, destructive shell commands in install documentation can still cause unintended data loss if copied blindly, expanded unexpectedly, or modified in the wrong environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes Python scripts, uses environment variables for secrets, writes to a local workspace, and communicates with a remote gateway, but it does not declare any explicit tool scope or permission boundaries. That mismatch can cause the host agent to grant broader capabilities than reviewers expect, increasing the risk of unintended shell, file, network, and secret access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill hardcodes Asia/Shanghai in diagnostic/API requests and also uses it as the default timezone in CLI arguments. This imposes a specific locale setting without explicit user choice or justification in the code shown, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill contains self-update and local repair behavior unrelated to its stated financial-analysis purpose. This makes the skill more dangerous in context because users expect market-data functionality, not code lifecycle management that can modify or replace local files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

This subprocess call invokes an external package-management style command from within the skill's doctor flow. Even though arguments are passed safely as a list and there is no shell injection here, it still performs privileged local state changes by reinstalling code from an external source, which expands the skill's trust boundary and can execute attacker-controlled code if the upstream distribution is compromised.

Content

Scanner excerpt · scripts/stocki.py (reported line 223)May include surrounding context.

python
"""Try to reinstall skill via clawhub, then GitHub."""
    print("      Reinstalling skill...")
    try:
        r = subprocess.run(["clawhub", "install", "stocki", "--force"],
                           capture_output=True, text=True, timeout=30)
        if r.returncode == 0:
            print("      -> Reinstalled via clawhub")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

This command recursively deletes the skill directory with no user confirmation before reinstalling. The code attempts a weak path sanity check, but it is insufficient defense against unexpected path resolution, symlink issues, or logic errors, making destructive data loss possible during a routine doctor run.

Content

Scanner excerpt · scripts/stocki.py (reported line 235)May include surrounding context.

python
print("      -> Reinstall aborted: unexpected skill directory path")
        return False
    try:
        subprocess.run(["rm", "-rf", SKILL_DIR], check=True)
        r = subprocess.run(
            ["git", "-c", "http.postBuffer=524288000", "-c", "http.lowSpeedLimit=0",
             "-c", "http.lowSpeedTime=300", "clone",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

This subprocess clones and reinstalls code directly from GitHub during a repair operation. That creates a software supply-chain risk because the local environment will trust and run newly fetched code without signature verification, version pinning, or user review.

Content

Scanner excerpt · scripts/stocki.py (reported line 236)May include surrounding context.

python
return False
    try:
        subprocess.run(["rm", "-rf", SKILL_DIR], check=True)
        r = subprocess.run(
            ["git", "-c", "http.postBuffer=524288000", "-c", "http.lowSpeedLimit=0",
             "-c", "http.lowSpeedTime=300", "clone",
             "https://github.com/stocki-ai/open-stocki.git", SKILL_DIR],

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stocki.py (reported line 264)May include surrounding context.

python
if not api_key:
        print("[1/6] API Key.............. FAIL")
        print("      No API key set. Register at:")
        print("      https://api.stocki.com.cn/wechat")
        print('      Then: export STOCKI_API_KEY="sk_your_key_here"')
        failed += 1
    elif not api_key.startswith("sk_"):

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:22