ClawHub
Back to skill

Security audit

India NSE stock market data

Security checks for vulnerabilities and agentic risk

Overview

The skill’s stock-data purpose is clear, but it asks users to run an unpinned external npm gateway and includes an API-key curl example that can expose the key in verbose logs.

Review the npm package and prefer a pinned, reviewed version before installing. Avoid global installation when possible, remove curl verbose mode, keep the OneKey API key out of logs and screenshots, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding
Unpinned Third-Party npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 8-12 and 52-57 **Vulnerability Type**: Unpinned and externally maintained executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: npm: - "@aiagenta2z/onekey-gateway" installation: npm: npm -g install @aiagenta2z/onekey-gateway ``` ```shell ## install onekey agent gateway npm install @aiagenta2z/onekey-gateway ## CLI to Call API and Symbol List npx onekey agent aiagenta2z/financeagent get_india_stock_market_nse_india '{"symbol_list": ["TM03", "IT"]}' ``` ### Technical Analysis The Skill directs users to install and execute `@aiagenta2z/onekey-gateway` without specifying an exact version or package integrity value. Consequently, the installed code is determined by the package registry state at installation time rather than by the reviewed Skill artifact. npm packages can execute code through lifecycle scripts during installation and through their command-line entry points at runtime. The globally installed variant increases the potential system-wide effect and may expose the executable to unrelated sessions. The dependency's implementation is not included in this project, so its behavior could not be verified as part of this audit. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future package release. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the Skill instructions without an explicit version pin. 4. npm resolves and installs the attacker-controlled release. 5. Malicious lifecycle scripts or CLI code execute with the privileges of the user running npm or `npx`. 6. The payload can access files, credentials, environment variables, and network resources available to that user. ### Impact Assessment Exploitation could result in arbitrary code execution under the installing user's privileges. Acce ...[truncated 453 chars]
Remediation
## Remediation Suggestions - Pin the dependency to a reviewed exact version rather than relying on the latest registry release. - Verify the package tarball with a trusted integrity hash or signature. - Use a committed lockfile and `npm ci` for reproducible installation where the project structure permits it. - Disable lifecycle scripts with `--ignore-scripts` if they are not required. - Avoid global installation and execute the dependency in a restricted, least-privileged environment. - Review the package source, maintainers, publication history, transitive dependencies, and lifecycle scripts before approving it. - Consider vendoring or otherwise locking a reviewed artifact so the effective code cannot change after the Skill review.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:63
Finding
API Credential Exposed Through Verbose curl Logging## Vulnerability Details **File Location**: `SKILL.md`, lines 63-76 **Vulnerability Type**: Sensitive authentication header disclosure through verbose command output **Risk Level**: Medium ### Vulnerable Code ```shell export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -v -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{ "unique_id": "aiagenta2z/financeagent", "api_id": "get_india_stock_market_nse_india", "data": { "symbol_list": ["TM03", "IT"] } }' ``` ### Technical Analysis The documented command enables curl's verbose mode with `-v` while transmitting the OneKey credential in the `X-OneKey` request header. Verbose curl output includes outgoing request headers on standard error. After shell expansion, this can disclose the actual value of `DEEPNLP_ONEKEY_ROUTER_ACCESS`. HTTPS protects the request while it is in transit but does not prevent curl from printing the header locally before transmission. The credential can therefore be retained by CI logs, terminal recording systems, redirected standard-error files, troubleshooting transcripts, or other command-output collection mechanisms. ### Attack Path 1. A user exports a valid OneKey access credential. 2. The user executes the documented verbose curl command. 3. curl prints the expanded `X-OneKey` request header to standard error. 4. A CI system, terminal recorder, logging agent, redirected output file, or support transcript retains the verbose output. 5. A person or process with access to that output extracts the credential. 6. The exposed key is replayed against the OneKey Gateway until it is revoked, expires, or is otherwise restricted. ### Impact Assessment An attacker obtaining the key could make gateway requests with the permissions assigned to that credential. The resulting impact may include unauthorized API use, ...[truncated 265 chars]
Remediation
## Remediation Suggestions - Remove `-v` from the documented command. - Use `--silent --show-error` when concise operational diagnostics are required. - If verbose troubleshooting is unavoidable, redact the `X-OneKey` header before storing or sharing output. - Configure CI and terminal-recording systems to mask the credential value. - Use a short-lived, narrowly scoped credential where supported. - Rotate any credential that may already have appeared in retained verbose logs. - Restrict access to historical command logs and delete exposed copies according to the applicable retention policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The HTTP example instructs users to place the API key directly into an HTTP header but provides no warning about protecting secrets in shell history, logs, screenshots, CI output, or shared terminals. In documentation, this omission can lead to accidental credential exposure even if the API call itself is legitimate.

External Transmission

Medium
Category
Data Exfiltration
Content
```shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.