ClawHub
Back to skill

Security audit

India NSE stock market data

Security checks for vulnerabilities and agentic risk

Overview

The skill’s stock-data purpose is clear, but it asks users to run an unpinned external npm gateway and includes an API-key curl example that can expose the key in verbose logs.

Review the npm package and prefer a pinned, reviewed version before installing. Avoid global installation when possible, remove curl verbose mode, keep the OneKey API key out of logs and screenshots, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party npm Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-12 and 52-57
Vulnerability Type: Unpinned and externally maintained executable dependency
Risk Level: Medium

Vulnerable Code

yaml
dependencies:
  npm:
    - "@aiagenta2z/onekey-gateway"
installation:
  npm: npm -g install @aiagenta2z/onekey-gateway
shell
## install onekey agent gateway
npm install @aiagenta2z/onekey-gateway

## CLI to Call API and Symbol List
npx onekey agent aiagenta2z/financeagent get_india_stock_market_nse_india '{"symbol_list": ["TM03", "IT"]}'

Technical Analysis

The Skill directs users to install and execute @aiagenta2z/onekey-gateway without specifying an exact version or package integrity value. Consequently, the installed code is determined by the package registry state at installation time rather than by the reviewed Skill artifact.

npm packages can execute code through lifecycle scripts during installation and through their command-line entry points at runtime. The globally installed variant increases the potential system-wide effect and may expose the executable to unrelated sessions. The dependency's implementation is not included in this project, so its behavior could not be verified as part of this audit.

Attack Path

  1. An attacker compromises the npm publisher account, registry distribution path, or a future package release.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the Skill instructions without an explicit version pin.
  4. npm resolves and installs the attacker-controlled release.
  5. Malicious lifecycle scripts or CLI code execute with the privileges of the user running npm or npx.
  6. The payload can access files, credentials, environment variables, and network resources available to that user.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing user's privileges. Acce ...[truncated 453 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version rather than relying on the latest registry release.
  • Verify the package tarball with a trusted integrity hash or signature.
  • Use a committed lockfile and npm ci for reproducible installation where the project structure permits it.
  • Disable lifecycle scripts with --ignore-scripts if they are not required.
  • Avoid global installation and execute the dependency in a restricted, least-privileged environment.
  • Review the package source, maintainers, publication history, transitive dependencies, and lifecycle scripts before approving it.
  • Consider vendoring or otherwise locking a reviewed artifact so the effective code cannot change after the Skill review.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:63
Finding

API Credential Exposed Through Verbose curl Logging

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-76
Vulnerability Type: Sensitive authentication header disclosure through verbose command output
Risk Level: Medium

Vulnerable Code

shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
    "unique_id": "aiagenta2z/financeagent",
    "api_id": "get_india_stock_market_nse_india",
    "data": {
      "symbol_list": ["TM03", "IT"]
    }
  }'

Technical Analysis

The documented command enables curl's verbose mode with -v while transmitting the OneKey credential in the X-OneKey request header. Verbose curl output includes outgoing request headers on standard error. After shell expansion, this can disclose the actual value of DEEPNLP_ONEKEY_ROUTER_ACCESS.

HTTPS protects the request while it is in transit but does not prevent curl from printing the header locally before transmission. The credential can therefore be retained by CI logs, terminal recording systems, redirected standard-error files, troubleshooting transcripts, or other command-output collection mechanisms.

Attack Path

  1. A user exports a valid OneKey access credential.
  2. The user executes the documented verbose curl command.
  3. curl prints the expanded X-OneKey request header to standard error.
  4. A CI system, terminal recorder, logging agent, redirected output file, or support transcript retains the verbose output.
  5. A person or process with access to that output extracts the credential.
  6. The exposed key is replayed against the OneKey Gateway until it is revoked, expires, or is otherwise restricted.

Impact Assessment

An attacker obtaining the key could make gateway requests with the permissions assigned to that credential. The resulting impact may include unauthorized API use, ...[truncated 265 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove -v from the documented command.
  • Use --silent --show-error when concise operational diagnostics are required.
  • If verbose troubleshooting is unavoidable, redact the X-OneKey header before storing or sharing output.
  • Configure CI and terminal-recording systems to mask the credential value.
  • Use a short-lived, narrowly scoped credential where supported.
  • Rotate any credential that may already have appeared in retained verbose logs.
  • Restrict access to historical command logs and delete exposed copies according to the applicable retention policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The HTTP example instructs users to place the API key directly into an HTTP header but provides no warning about protecting secrets in shell history, logs, screenshots, CI output, or shared terminals. In documentation, this omission can lead to accidental credential exposure even if the API call itself is legitimate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{