ClawHub
Back to skill

Security audit

Marketpulse

Security checks for vulnerabilities and agentic risk

Overview

MarketPulse is a disclosed financial-data API skill that uses an AIsa API key to fetch market information, with no evidence of hidden persistence, local data harvesting, or destructive behavior.

Install this only if you are comfortable giving the skill access to an AISA_API_KEY and sending requested tickers, watchlists, screener filters, and similar market-research parameters to AIsa's API. Use a dedicated least-privilege API key if available and avoid sending sensitive portfolio notes unless needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
60% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares required environment access and clearly performs authenticated network requests, but it does not define an explicit tool/permission scope such as allowed-tools or permissions. In an agent harness, this can lead to overbroad invocation and unclear review boundaries, making it easier for the skill to access secrets and send data externally without fine-grained policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation description is broad enough to match many common finance-related user requests, including stock analysis, watchlists, and portfolio workflows, without clear activation boundaries. In an agent ecosystem this can cause the skill to be selected too often, unnecessarily granting it access to environment secrets and network egress when a simpler or safer capability might have sufficed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The documentation establishes a fixed external endpoint at api.aisa.one, confirming that the skill depends on third-party network egress. Even though the domain is not user-controlled here, use of an external API still creates a confidentiality and supply-chain boundary where prompts, parameters, and metadata may leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The documentation establishes a fixed external endpoint at api.aisa.one, confirming that the skill depends on third-party network egress. Even though the domain is not user-controlled here, use of an external API still creates a confidentiality and supply-chain boundary where prompts, parameters, and metadata may leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash
# Historical price data (daily)
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=day&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example shows another authenticated call to the same third-party API, reinforcing that the skill routinely transmits data and credentials externally. Repeated unaudited egress pathways increase the chance that future user inputs or workflow state could be sent out more broadly than intended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
-H "Authorization: Bearer $AISA_API_KEY"

# Weekly price data
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=week&interval_multiplier=1&start_date=2025-01-01&end_date=2025-12-31" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Minute-level data (intraday)

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The intraday price example continues the pattern of external authenticated transmission. The risk is not the market-data function itself, but that an agent using this skill may relay user intent, watchlists, or analysis targets to a third-party service under a live credential.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Minute-level data (intraday)

curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&interval=minute&interval_multiplier=5&start_date=2025-01-15&end_date=2025-01-15"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Fetching company news requires sending a ticker and bearer token to an external provider. In a broader agent workflow, this establishes a recurring external data-sharing path and should be treated as a trust boundary rather than a harmless local lookup.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

bash
# Get news by ticker
curl "https://api.aisa.one/apis/v1/financial/news?ticker=AAPL&limit=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The financial statements endpoint is another authenticated external transmission channel. The danger is contextual: a user may ask for portfolio or watchlist analysis, and identifiers or derived investment interests could be exposed to the external API provider.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash
# All financial statements (requires period)
curl "https://api.aisa.one/apis/v1/financial/financials?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Income statements

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This income-statement example shows the same external egress pattern with credential use. While normal for an API-backed skill, it is still a real security concern because it relies on external transmission without any declared permission scoping in the manifest.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
-H "Authorization: Bearer $AISA_API_KEY"

# Income statements
curl "https://api.aisa.one/apis/v1/financial/financials/income-statements?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Balance sheets

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Balance-sheet retrieval sends authenticated requests to a third-party domain. This is a legitimate function, but it remains a confidentiality boundary and should not be treated as a false positive merely because the endpoint appears business-related.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
-H "Authorization: Bearer $AISA_API_KEY"

# Balance sheets
curl "https://api.aisa.one/apis/v1/financial/financials/balance-sheets?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Cash flow statements

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Cash-flow queries also require external authenticated transmission. If embedded in automated portfolio workflows, repeated calls may reveal user interests or strategy themes to the provider, which is a moderate privacy and governance concern.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Cash flow statements

curl "https://api.aisa.one/apis/v1/financial/financials/cash-flow-statements?ticker=AAPL&period=annual"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Segmented revenue queries continue the same pattern of sending data to a third-party API with a bearer token. The function is expected, but the skill's context makes the risk real because investment-research workflows can aggregate sensitive watchlist or strategy information.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

bash
# Break down revenue by business segment and geography
curl "https://api.aisa.one/apis/v1/financial/financials/segmented-revenues?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Real-time metrics access sends requests to an external service under the provided API key. The skill context does not suggest exfiltration of arbitrary local files, but it still exposes an authenticated egress path that should be formally scoped and reviewed.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash
# Real-time financial metrics snapshot
curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Historical financial metrics (period required)

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Historical metrics retrieval is another concrete example of external transmission. Because the skill is user-invocable and broadly described, these egress operations may trigger in more situations than necessary, increasing risk exposure.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Historical financial metrics (period required)

curl "https://api.aisa.one/apis/v1/financial/financial-metrics?ticker=AAPL&period=annual"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Analyst estimates are retrieved through authenticated calls to a third-party API. This is not inherently malicious, but it is a real exposure channel for user-requested financial interests and credential use.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

bash
# Earnings per share estimates
curl "https://api.aisa.one/apis/v1/financial/analyst-estimates?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Earnings press release retrieval again demonstrates routine external egress using a bearer token. In a skill analysis context, repeated network calls to a third-party service are a legitimate medium-severity concern even when they implement expected functionality.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

bash
# Get earnings press releases
curl "https://api.aisa.one/apis/v1/financial/earnings/press-releases?ticker=NVDA" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Insider-trade lookups send ticker data externally and authenticate with AISA_API_KEY. Because this skill supports 'portfolio workflows' and 'whale watching,' the external provider may infer a user's analysis interests over time.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

bash
# Get insider trades
curl "https://api.aisa.one/apis/v1/financial/insider-trades?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Institutional ownership queries create the same third-party transmission boundary. The issue is made slightly more significant by the ability to query by ticker or investor, which could disclose more about a user's research targets.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

bash
# Get institutional ownership (by ticker OR investor)
curl "https://api.aisa.one/apis/v1/financial/institutional-ownership?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

SEC filings retrieval uses authenticated external requests. This is expected functionality, but it still constitutes off-platform transmission and dependency on a third-party service for content retrieval.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

bash
# Get SEC filings
curl "https://api.aisa.one/apis/v1/financial/filings?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Get SEC filing items (requires filing type and year)

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Fetching filing items adds more structured user-supplied parameters to an external request, increasing the importance of strict validation. The presence of many such examples indicates the skill is heavily network-dependent despite lacking explicit tool scope.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Get SEC filing items (requires filing type and year)

curl "https://api.aisa.one/apis/v1/financial/filings/items?ticker=AAPL&filing_type=10-K&year=2024"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Company facts retrieval is another authenticated call to a third-party endpoint. The risk remains moderate because the skill's business purpose requires this egress, but the trust boundary and secret usage are real.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

bash
# Get company facts (by ticker or CIK)
curl "https://api.aisa.one/apis/v1/financial/company/facts?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The screener endpoint sends a structured JSON body externally, which increases the amount of potentially revealing user strategy information shared with the provider. Screening criteria can encode proprietary trading heuristics or research preferences, so this is somewhat more sensitive than simple single-ticker lookups.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

bash
# Screen for stocks matching criteria
curl -X POST "https://api.aisa.one/apis/v1/financial/financials/search/screener" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filters":{"pe_ratio":{"max":15},"revenue_growth":{"min":0.2}}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Line-item search transmits batches of tickers and financial metrics to an external service, potentially revealing a user's watchlist or comparative research set. In an autonomous-agent context, this can expose richer strategic patterns than one-off lookups.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

bash
# Search specific financial line items across tickers
curl -X POST "https://api.aisa.one/apis/v1/financial/financials/search/line-items" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tickers":["AAPL","MSFT"],"line_items":["revenue","net_income"],"period":"annual"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Interest-rate snapshot retrieval sends an authenticated request to a third-party service, but this specific request is less sensitive because it does not encode user-specific financial targets. It still represents external transmission and secret use, so it is not a false positive.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

bash
# Current interest rates
curl "https://api.aisa.one/apis/v1/financial/macro/interest-rates/snapshot" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Historical interest rates

Static analysis

No suspicious patterns detected.