ClawHub
Back to skill

Security audit

20位投资大师帮你分析股票

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill mostly matches its stated purpose, but it needs review because it bundles a reusable market-data API token, can auto-run lookups, and gives buy/sell guidance without clear warnings.

Review before installing. Expect outbound financial-data requests and Chinese-language investment-style reports. Do not rely on its buy/sell outputs as financial advice, and do not use the bundled Tushare token; the publisher should rotate it and require users to configure their own credential. Be aware one helper script writes ETF history to a fixed local path.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
investment_system/etf_monitor.py:27
Finding

Hard-Coded Tushare API Token in ETF Monitor

Content
View full analysis

Vulnerability Details

File Location: investment_system/etf_monitor.py:27-29
Vulnerability Type: Hard-coded API credential
Risk Level: Medium

python
        token = 'b8ef516ff4abecadc1cdb55956458c3fed0378f8f85c30460f0d4500'
        ts.set_token(token)
        pro = ts.pro_api()

Technical Analysis

A reusable Tushare API token is embedded directly in the source code. Anyone with access to the source package can recover the token without authentication and configure a separate Tushare client to act under the associated account.

The token is passed to ts.set_token() and subsequently used by the Tushare Pro client. Although the reviewed code uses it only to retrieve northbound-capital data, the credential is not technically restricted by this local implementation. Its effective privileges are determined by the associated Tushare account and provider-side controls.

Attack Path

  1. An attacker downloads, installs, or otherwise obtains read access to the project.
  2. The attacker reads investment_system/etf_monitor.py.
  3. The attacker extracts the plaintext token from line 27.
  4. The attacker initializes an independent Tushare client with the recovered token.
  5. Requests are made against the provider under the token owner's account until the token is revoked or provider-side limits are reached.

No local privilege escalation or host compromise follows directly from this flaw.

Impact Assessment

An attacker may consume the account's API quota, trigger rate limits, access data available to the associated Tushare subscription, and cause account suspension or service disruption. The precise data-access scope depends on the provider privileges assigned to the token.

The issue does not provide operating-system privileges and does not expose unrelated user credentials based on the reviewed evidence.

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed token immediately because removing it from the current source does not invalidate copies in package archives or version history.
  2. Read the replacement token from a protected environment variable or secret manager:
    python
    import os

token = os.environ.get("TUSHARE_TOKEN")
if not token:
    raise RuntimeError("TUSHARE_TOKEN is not configured")

ts.set_token(token)
  3. Never commit .env files containing real credentials. Provide an .env.example containing only placeholder values.
  4. Restrict the replacement token's provider-side permissions and quota to the minimum required by the feature.
  5. Add automated secret scanning to pre-commit checks and CI.
  6. Review repository history and distributed release artifacts for additional copies of the exposed token.

T09 · Insecure Skill Coding Practices

Warning
Location
investment_system/get_north_money.py:10
Finding

Hard-Coded Tushare API Token in Northbound-Capital Script

Content
View full analysis

Vulnerability Details

File Location: investment_system/get_north_money.py:10-19
Vulnerability Type: Hard-coded API credential
Risk Level: Medium

python
TOKEN = 'b8ef516ff4abecadc1cdb55956458c3fed0378f8f85c30460f0d4500'

def get_north_money(date=None):
    """获取北向资金流向"""
    if date is None:
        date = sys.argv[1] if len(sys.argv) > 1 else '20250417'
    
    try:
        ak.set_token(TOKEN)
        pro = ak.pro_api()

Technical Analysis

The module exposes the same reusable Tushare credential as a global plaintext constant. It is recoverable through direct source inspection and is actively supplied to the Tushare SDK by ak.set_token(TOKEN).

Defining the credential at module scope also makes it accessible to any Python code that imports this module. The local script does not impose an authorization boundary or provider-side scope restriction on subsequent use of the recovered token.

Attack Path

  1. An attacker obtains the project source or an installed copy of the module.
  2. The attacker reads the TOKEN constant directly or imports the module and accesses TOKEN.
  3. The attacker configures a separate Tushare client using the recovered value.
  4. The attacker performs API operations allowed by the associated account.
  5. Abuse continues until provider controls intervene or the credential is revoked.

Impact Assessment

The exposed credential may allow unauthorized use of the associated Tushare account, including depletion of API quota, triggering of rate limits, and access to subscription data available to that token. It may also cause operational disruption if the provider revokes or suspends the account following abuse.

The finding does not grant local operating-system privileges or arbitrary code execution. Its scope is limited to the external service permissions associated with the token.

Remediation
View remediation

Remediation Suggestions

  1. Revoke the exposed token and issue a new credential.
  2. Remove the TOKEN global from the source and retrieve the token at runtime from an environment variable or secret manager:
    python
    import os

def get_tushare_client():
    token = os.environ.get("TUSHARE_TOKEN")
    if not token:
        raise RuntimeError("TUSHARE_TOKEN is not configured")
    ak.set_token(token)
    return ak.pro_api()
  3. Avoid exporting credentials as module-level attributes.
  4. Apply minimum provider-side entitlements and quota restrictions to the replacement token.
  5. Add secret-detection controls to development and release pipelines.
  6. Purge the credential from version history where feasible, while treating rotation as mandatory regardless of history rewriting.

T09 · Insecure Skill Coding Practices

Note
Location
investment_system/fetch_etf_history.py:13
Finding

Unsafe Machine-Specific Absolute Output Path

Content
View full analysis

Vulnerability Details

File Location: investment_system/fetch_etf_history.py:13,93-110
Vulnerability Type: Unsafe fixed file destination
Risk Level: Low

python
HISTORY_FILE = "/Users/amitabhama/Downloads/etf_history.csv"
python
def init_history_file():
    if not os.path.exists(HISTORY_FILE):
        with open(HISTORY_FILE, 'w', newline='') as f:
            writer = csv.writer(f)
            writer.writerow(['date', 'code', 'name', 'price', 'change', 'volume', 'amount'])

def save_to_history(date, code, name, price, change, volume, amount):
    existing = []
    if os.path.exists(HISTORY_FILE):
        with open(HISTORY_FILE, 'r') as f:
            reader = csv.DictReader(f)
            existing = list(reader)
    
    exists = any(row['date'] == date and row['code'] == code for row in existing)
    
    if not exists:
        with open(HISTORY_FILE, 'a', newline='') as f:
            writer = csv.writer(f)
            writer.writerow([date, code, name, price, change, volume, amount])

Technical Analysis

The script writes ETF history to an absolute path tied to a specific named user's Downloads directory. The destination cannot be selected by the caller and is not derived from a safe application-data directory.

If the path exists on the executing system, the script reads and appends to it without checking file ownership, file type, or whether the destination is a symbolic link. This can result in modification of an unintended file. On most other systems, the parent directory will not exist, causing a reliability failure.

Exploitation requires the attacker to have sufficient prior filesystem access to create or replace the destination with a link or controlled file. Therefore, this is not an independent privilege-escalation primitive, but it can redirect writes made with the script runner's existing privileges.

Attack Path

  1. The script is scheduled or in ...[truncated 1017 chars]
Remediation
View remediation

Remediation Suggestions

  1. Accept the output path through a command-line option or function parameter.
  2. Use a platform-appropriate application-data directory as the default rather than a named user's Downloads directory.
  3. Create the parent directory explicitly with restrictive permissions.
  4. Resolve and validate the destination before writing.
  5. Where supported, reject symbolic-link destinations and use no-follow file-opening semantics.
  6. Open newly created files with restrictive permissions and perform atomic writes when replacing content.
  7. Clearly document all persistent files created by the script.

Example safer configuration:

python
from pathlib import Path

def get_history_file(output=None):
    if output:
        return Path(output).expanduser().resolve()

    data_dir = Path.home() / ".local" / "share" / "investment_gurus"
    data_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
    return data_dir / "etf_history.csv"

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (63)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The auto-trigger conditions are very broad: any stock name, 6-digit code, or common words like '买', '卖', '分析', and '投资' can activate the skill. In an agent context, this can cause unintended execution and external market-data fetching during ordinary conversation, creating prompt-routing collisions and surprising network access without clear user intent.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The hardcoded API token is a directly exposed secret that can be copied by any reader of the repository, artifact, logs, or deployed file. In this investment-monitoring context, the credential grants real access to an external market-data service, so exposure can enable unauthorized use, quota theft, provider sanctions, and loss of control over the associated account.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-trigger keywords are very broad, including common terms like '买', '卖', '分析', '怎么样', and '能买吗', which can appear in ordinary conversation. In an agent-integrated finance skill, this raises the chance of unintended invocation on unrelated user messages, causing unsolicited financial analysis, unnecessary data access, and possible disclosure of sensitive investment intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly markets '智能分析' and '生成投资建议' without any disclaimer that outputs are informational only and not financial advice. In a skill designed to answer stock-buying questions, users may over-trust recommendations and act on them, increasing the risk of harmful financial decisions and potential regulatory/compliance exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill advertises automatic stock data retrieval but does not clearly warn users that it will contact external network sources like Tencent Finance or Yahoo Finance. This reduces transparency and informed consent, and in some deployments may expose user queries or inferred interests to third-party services unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring promises a complete ai-hedgefund-style implementation with 20 gurus analyzing across four dimensions. In practice, the China-guru section is hardcoded static text at L405-L418, and the technical/sentiment dimensions are explicitly unimplemented placeholders at L455-L459, so the documentation overstates what the code actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Natural-language strings, class metadata, and all user-facing responses are exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This can violate a language/locale policy that requires opt-in or explicit justification for locale constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill performs network-based retrieval of stock data (via Tencent API and potentially yfinance) without notifying the user that their query may trigger outbound requests. In an agent-skill context, silent external calls can expose user interests or query-derived identifiers to third parties and violate privacy or deployment expectations, especially in restricted or regulated environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring presents the skill entirely in Chinese, and the rest of the file continues with Chinese-only docstrings, messages, and recommendation strings. This effectively forces a specific language/locale without user opt-in or a documented justification that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Module docstrings, comments, and generated report text are exclusively in Chinese, which effectively forces a specific language/locale on users. The policy allows locale constraints only when they are explicitly justified or when users are given a language choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code calls yfinance to retrieve quote and history data from external sources, which necessarily transmits the requested stock symbol and system network metadata off-box. While the module docstrings describe data retrieval, there is no explicit user-facing warning, confirmation, or disclosure in this file that external network access will occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The code fetches historical price data from an external provider in several methods, including K-line and trend retrieval, but does not clearly warn users that external HTTP requests are part of execution. For a data skill, network use may be expected, yet this file provides no explicit disclosure beyond implementation details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill generates concrete stock recommendations, scoring outputs, and a suggested holding period of 3-5+ years without any disclaimer that the content is informational and not financial advice. In a financial-analysis context, this can cause users to over-trust the output as personalized or authoritative investment guidance, increasing the risk of harmful financial decisions and potential compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file presents its module description and all user-facing reports in Chinese, indicating a fixed locale experience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation because users are not given a choice or documented justification for the locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill explicitly promotes concentrated positions and extremely long holding periods as part of its core strategy, but it contains no user-facing warning that this is opinionated financial content and may be unsuitable for many investors. In an investment-analysis skill, presenting high-risk portfolio behavior without suitability checks, diversification warnings, or a disclaimer can mislead users into taking outsized financial risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module docstrings, usage examples, and user-facing report strings are entirely in Chinese, including the example user utterance at L025 and generated output descriptions through the file. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill’s user-facing natural-language content, including module and method docstrings and output strings, is entirely in Chinese with no indication that users can choose another language or that the locale restriction is intentional. This can violate a language/locale policy when a skill is expected to support user preference rather than implicitly enforcing one language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language strings in the module docstring and runtime output are written exclusively in Chinese, and the skill does not provide any option to select another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file embeds a live Tushare API token directly in source code, which gives anyone who can read the file the ability to reuse that credential against the external financial data service. Even if the script's purpose is legitimate, hardcoding third-party credentials creates unauthorized capability expansion, makes secret rotation difficult, and can lead to account abuse, quota exhaustion, or billing and attribution risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code silently uses an embedded API token to access a third-party financial data service without any user disclosure or consent flow. This is risky because users or operators may unknowingly trigger external authenticated requests under someone else's account, causing compliance, auditability, and unexpected usage issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains user-facing natural language that forces a specific language/locale in the module docstring and throughout the script. Under the policy, locale constraints should be optional or clearly justified; here there is no opt-in or explanation that the skill is intended only for Chinese-speaking users or China-market data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The printed banners, status messages, and labels are all emitted only in Chinese. Because these are user-visible outputs and no alternative language or explicit locale limitation is provided, this is a natural-language policy issue rather than a code-security flaw.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script embeds a live API token directly in source code, which exposes the credential to anyone with file access and makes accidental leakage through repositories, logs, or package distribution very likely. Because the token enables authenticated access to a third-party financial data service, an attacker could reuse it for unauthorized API calls, consume quota, or cause account abuse attributed to the owner.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code uses the hardcoded token to establish authenticated network access without any user disclosure, configuration boundary, or consent mechanism. In an agent skill context, this is more concerning because invoking the skill silently triggers third-party API usage under the developer's credential, which can hide data flows, incur costs, and make misuse harder to detect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file hardcodes user-facing natural-language content in Chinese throughout docstrings, signals, report text, and console output. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation because the skill does not offer any language or locale choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.