ClawHub
Back to skill

Security audit

Hong Kong Stock Market HKEX

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for HKEX market data, but it documents credential-bearing commands in a way that can expose the API key and relies on an unpinned executable npm package.

Install only if you trust the OneKey Gateway provider and npm package publisher. Prefer a pinned, project-local package install, avoid global npm installation, remove curl -v from credentialed requests, and keep DEEPNLP_ONEKEY_ROUTER_ACCESS out of logs, shell history, CI output, and support transcripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding
Unpinned Third-Party npm Package Can Execute Unreviewed Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9–11 and 46–50 **Vulnerability Type**: Unpinned third-party dependency and unsafe package execution **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" installation: npm: npm -g install @aiagenta2z/onekey-gateway ``` ```shell ## install onekey agent gateway npm install @aiagenta2z/onekey-gateway ## CLI to Call API and Symbol List npx onekey agent aiagenta2z/financeagent get_hk_stock_market_hkex '{"symbol_list": ["700", "1024"]}' ``` ### Technical Analysis The Skill instructs users to install `@aiagenta2z/onekey-gateway` without specifying an exact version or integrity hash. Package resolution can therefore select a newer package version that was not present during this audit. npm package installation may execute package lifecycle scripts with the privileges of the invoking user. The documented global installation also increases the package's reach within the user's environment. The subsequent `npx onekey` command executes the installed package's CLI code. No evidence establishes that the current package is malicious. The vulnerability is that the Skill does not constrain or verify the executable third-party dependency, leaving execution behavior dependent on mutable package-registry content. ### Attack Path 1. An attacker compromises the package publisher, registry account, publication process, or another part of the dependency supply chain. 2. The attacker publishes a malicious version under the same package name. 3. A user follows the Skill instructions without an exact version constraint. 4. npm resolves and downloads the attacker-controlled release. 5. Malicious lifecycle scripts can run during installation, or malicious CLI logic can run when `npx onekey` is invoked. 6. The payload executes with the permissions of the user running npm. ### Impact Assessment Successful exploitation could permit arbitrary code execution ...[truncated 490 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an audited exact version rather than using an unconstrained package name. 2. Record and verify package integrity information through a committed lockfile. 3. Prefer a project-local installation using `npm ci` over global installation. 4. Invoke the already installed binary with `npx --no-install` so that execution cannot trigger an implicit download. 5. Review the package's lifecycle scripts, transitive dependencies, publisher identity, and registry provenance before approval. 6. Run the package with a dedicated, least-privileged account or sandbox and expose only the environment variables and files required for the market-data request. 7. Add automated dependency monitoring and require security review before updating the pinned version. A safer documented workflow would resemble: ```shell npm install --save-exact @aiagenta2z/onekey-gateway@<audited-version> npx --no-install onekey agent aiagenta2z/financeagent \ get_hk_stock_market_hkex '{"symbol_list":["700","1024"]}' ``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:58
Finding
Verbose curl Command Discloses the OneKey API Credential<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–70 **Vulnerability Type**: Sensitive credential exposure through verbose diagnostic output **Risk Level**: Medium ### Vulnerable Code ```shell export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -v -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{ "unique_id": "aiagenta2z/financeagent", "api_id": "get_hk_stock_market_hkex", "data": { "symbol_list": ["700", "1024"] } }' ``` ### Technical Analysis The documented command enables curl's verbose mode with `-v`. Verbose mode writes connection diagnostics and outgoing request headers to standard error. Because the API credential is inserted directly into the `X-OneKey` request header, the expanded credential can appear in terminal output, CI logs, captured build output, support transcripts, or session recordings. TLS protects the request while it is transmitted to the HTTPS endpoint, but it does not prevent curl from displaying the header locally before or during transmission. The issue is therefore local credential disclosure rather than plaintext network transport. ### Attack Path 1. A user exports a valid credential in `DEEPNLP_ONEKEY_ROUTER_ACCESS`. 2. The user executes the documented `curl -v` command. 3. curl emits the outgoing `X-OneKey` header, including the expanded secret, to standard error. 4. The output is retained by a CI system, terminal logger, shell-session recorder, monitoring agent, or copied into a support report. 5. A person or service with access to that output obtains the credential. 6. The exposed key can be reused against the OneKey Gateway until it expires or is revoked. ### Impact Assessment An attacker who obtains the credential may make API requests under the victim's OneKey account, subject to the permissions and limits assigned to that key. This may result in unauthorized API consu ...[truncated 306 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove `-v` from the standard usage example. 2. Use failure-aware but non-verbose options such as `--fail-with-body --silent --show-error`. 3. Prohibit verbose HTTP traces in shared terminals, CI jobs, and support captures when authorization headers are present. 4. If diagnostics are unavoidable, capture sanitized output and redact the complete `X-OneKey` header before retaining or sharing it. 5. Use narrowly scoped, short-lived credentials where the gateway supports them. 6. Rotate the API key immediately if verbose output containing the key has already been stored or disclosed. 7. Configure CI and logging systems to mask the credential value, while recognizing that masking is a secondary control rather than a replacement for removing `-v`. A safer command is: ```shell curl --fail-with-body --silent --show-error \ -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{ "unique_id": "aiagenta2z/financeagent", "api_id": "get_hk_stock_market_hkex", "data": { "symbol_list": ["700", "1024"] } }' ``` ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs users to export and send an API key in CLI and curl examples but provides no warning about sensitive credential handling, shell history exposure, log leakage, or secret management practices. In documentation for an externally connected tool, this omission can lead to accidental credential disclosure, especially when users copy commands into shared terminals, CI logs, or support channels.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium
Category
Data Exfiltration
Content
```shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.