ClawHub
Back to skill

Security audit

US Stock Market NYSE NASDAQ DOW

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated stock-market API purpose, but it asks users to run an unpinned npm gateway and includes a verbose curl example that can expose the API key in logs.

Review the provider and npm package before installing. Prefer a pinned, project-local package version, avoid global installation when possible, remove curl -v from commands that include X-OneKey, keep DEEPNLP_ONEKEY_ROUTER_ACCESS out of logs and screenshots, and rotate the key if it was ever captured in verbose output.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party npm Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-10 and 47-51
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

yaml
dependencies:
  npm:
    - "@aiagenta2z/onekey-gateway"
installation:
  npm: npm -g install @aiagenta2z/onekey-gateway
shell
## install onekey agent gateway
npm install @aiagenta2z/onekey-gateway

## CLI to Call API and Symbol List
npx onekey agent aiagenta2z/financeagent get_us_stock_market_nyse_nasdaq_dow '{"symbol_list": ["TSLA", "MSFT", "GOOG"]}'

Technical Analysis

The dependency is specified without an exact version or integrity constraint. Consequently, the package version installed depends on the npm registry state at installation time rather than the version that was reviewed during this audit.

Both npm installation and the subsequent npx command can execute publisher-controlled code. npm packages may run lifecycle scripts during installation, while the installed CLI executes with the privileges of the invoking user. The global installation instruction further increases scope by placing package-controlled files in a shared executable location. The project contains no lockfile, vendored implementation, checksum, or package source code with which to verify the dependency's behavior.

This is a supply-chain weakness; the available evidence does not establish that the current package is malicious.

Attack Path

  1. An attacker compromises the package publisher, npm account, release process, or a transitive dependency.
  2. The attacker publishes a malicious package version under the same package name.
  3. A user follows the documented unpinned installation command.
  4. npm resolves and downloads the attacker-controlled release.
  5. Malicious lifecycle scripts execute during installation, or malicious logic executes when npx onekey is invoked.
  6. The payload acts with the priv ...[truncated 582 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed version rather than accepting the latest registry release.
  • Commit and enforce a lockfile containing integrity hashes.
  • Prefer a project-local installation over npm -g install.
  • Execute the already installed binary directly, or use npx --no-install, to prevent implicit downloads at invocation time.
  • Use npm ci --ignore-scripts when lifecycle scripts are unnecessary. If scripts are required, audit them explicitly before allowing execution.
  • Verify package ownership, provenance, signatures, and registry source before installation.
  • Run the tool as an unprivileged user in an isolated environment with only the required credential and filesystem access.
  • Periodically audit both the direct package and its transitive dependency tree.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:57
Finding

Gateway API Key Exposed by Verbose curl Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-70
Vulnerability Type: Sensitive credential disclosure through diagnostic output
Risk Level: Medium

Vulnerable Code

shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{
    "unique_id": "aiagenta2z/financeagent",
    "api_id": "get_us_stock_market_nyse_nasdaq_dow",
    "data": {
      "symbol_list": ["TSLA", "MSFT", "GOOG"]
    }
  }'

Technical Analysis

The example combines curl's verbose mode (-v) with a custom authentication header containing the expanded DEEPNLP_ONEKEY_ROUTER_ACCESS environment variable. Verbose mode writes request diagnostics, including outgoing headers, to standard error. Because X-OneKey is a custom header, its credential value may appear in terminal captures, CI/CD logs, support bundles, command transcripts, or other diagnostic records.

TLS protects the request while it is transported to the remote endpoint, but it does not prevent local disclosure through verbose diagnostic output. The issue is therefore independent of HTTPS transport security.

Attack Path

  1. A user or automated job configures a valid DEEPNLP_ONEKEY_ROUTER_ACCESS value.
  2. The documented curl example is executed with -v.
  3. curl writes the outgoing X-OneKey request header and its expanded value to standard error.
  4. The output is retained in a CI log, terminal recording, support artifact, or redirected diagnostic file.
  5. An unauthorized party with access to that output obtains the key.
  6. The party replays the key against the OneKey Gateway until it is revoked or expires.

Impact Assessment

An exposed key could permit unauthorized use of the gateway within the permissions, quotas, and lifetime assigned to that credential. Possible consequen ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove -v from the standard usage example.
  • If troubleshooting output is necessary, redact authentication headers before storing or sharing logs.
  • Configure CI/CD systems to mask DEEPNLP_ONEKEY_ROUTER_ACCESS and its resolved value.
  • Avoid enabling shell tracing such as set -x around commands that expand credentials.
  • Restrict access to logs and diagnostic artifacts, and apply short retention periods.
  • Use narrowly scoped, short-lived credentials where supported.
  • Rotate the gateway key immediately if it has appeared in verbose output that was stored or shared.
  • Document that users must never submit verbose output containing authentication headers in public issues or support channels.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to export an API key into an environment variable but provides no warning that the value is sensitive or guidance on preventing disclosure through shell history, logs, screenshots, or shared environments. While using environment variables is common, omitting credential-handling guidance raises the chance of accidental exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The documentation recommends invoking npx onekey without pinning an exact package version, which can cause users to execute whatever version is currently resolved from the registry. That increases supply-chain risk because a compromised, typosquatted, or breaking latest release could be fetched and run at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The curl example shows transmitting the API key and request payload to a third-party remote service without clearly warning the user that credentials and queried symbols are being sent off-host. In skill documentation, this lack of disclosure can mislead users about trust boundaries and increase the risk of unintended credential exposure or inappropriate data sharing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

shell
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

curl -v -X POST "https://agent.deepnlp.org/agent_router" \
  -H "Content-Type: application/json" \
  -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
  -d '{

Static analysis

No suspicious patterns detected.