ClawHub
Back to skill

Security audit

free-stock-global-quotes-news

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stock quote/news purpose, but it documents an optional privileged gateway-wide proxy change and uses a plaintext quote source that can let network intermediaries observe or alter market data.

Install only if you are comfortable with outbound market-data requests and optional Finnhub API-key use. Avoid the systemd-wide proxy setup unless an administrator intentionally wants all gateway traffic routed through that proxy, and treat CN/HK quotes from the Tencent plaintext source as unverified market data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cn_quote.py:106
Finding

Stock quote data is retrieved over unauthenticated plaintext HTTP

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:128
Finding

Documentation recommends a privileged, service-wide persistent proxy configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tainted flow: 'req' from os.environ.get (line 41, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/news.py (reported line 44)May include surrounding context.

python
req = request.Request(url, headers={"User-Agent": "OpenClaw/1.0"})
    for attempt in range(1 + NEWS_RETRIES):
        try:
            with request.urlopen(req, timeout=15) as r:
                data = json.loads(r.read().decode())
                return data if isinstance(data, list) else None
        except (error.HTTPError, error.URLError, json.JSONDecodeError, OSError) as e:

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description covers both stock quotes and news, plus specific source usage across markets. The supplied code is narrowly a news-fetching script: it detects CN/HK vs US symbols, fetches CN/HK news through a separate cn_news module (described in comments as EastMoney→AkShare) and US news via Finnhub's company-news endpoint. That means the actual behavior shown matches only the 'news' subset of the description, not the broader 'stock quotes and news' capability. It also does not show Yahoo or Tencent usage, which are part of the declared source description. Because the primary purpose in this chunk is materially narrower than the declared purpose, this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code clearly matches the stock quote portion of the description: it fetches quote data for symbols, including US and potentially CN/HK symbols, using Yahoo and Finnhub, with a local fallback module for CN/HK. However, there is no implementation of any news retrieval capability in this chunk, despite the declared description stating 'stock quotes and news.' Additionally, for CN/HK the declared sources are Tencent/EastMoney/AkShare, but this file itself does not access those services directly; it only attempts to load cn_quote.py for CN/HK handling. That source discrepancy is weaker because the delegated module may implement those providers, but based on this chunk alone, the direct behavior is quote-only. Therefore this is a description/behavior mismatch, primarily due to the missing news functionality.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
在 gateway 可读到的环境里设置即可，例如 `~/.openclaw/.env` 中加入 `HTTPS_PROXY=...` 和 `HTTP_PROXY=...`。或当前 shell 测试：`export HTTPS_PROXY=http://127.0.0.1:7890` 后执行 `python3 scripts/quote.py AAPL`。

   **可选：systemd 全局**（仅当你用 systemd 跑 gateway 且希望所有请求走代理时）  
   编辑 `/etc/systemd/system/openclaw-gateway.service` 在 `[Service]` 下增加 `Environment=HTTPS_PROXY=...` / `HTTP_PROXY=...`，然后 `sudo systemctl daemon-reload && sudo systemctl restart openclaw-gateway`。注意这会对该服务下所有请求生效。

**可选环境变量**（仅 `quote.py`）：`OPENCLAW_QUOTE_TIMEOUT`（默认 12 秒）、`OPENCLAW_QUOTE_RETRY_DELAY`（单 symbol 顺序时的间隔，默认 0.4 秒）、`OPENCLAW_QUOTE_CACHE_TTL`（结果缓存秒数，0=关闭）。多 symbol 时默认**并行**请求以提升性能，可通过 `OPENCLAW_QUOTE_PARALLEL=0` 关闭；`OPENCLAW_QUOTE_MAX_WORKERS`（默认 6）控制并行度。**失败重试**：`quote.py` 单次 HTTP 请求默认最多重试 2 次（共 3 次），5xx/超时/断线会指数退避；可通过 `OPENCLAW_QUOTE_RETRIES=0` 关闭。`cn_quote.py` 与 `news.py` 同样对单次请求做最多 2 次重试。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly documents use of environment variables and outbound network access, but it does not declare any tool scope such as permissions or allowed-tools. That creates a capability transparency gap: an agent or reviewer cannot easily constrain or audit what the skill is permitted to access, increasing the risk of unintended network use or leakage through inherited environment configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill includes substantial Chinese-language trigger examples and operational guidance such as Chinese-only stock-query phrases, but does not state that the skill is intended specifically for Chinese-speaking users or offer alternative language handling. This can violate language/locale policy because it effectively imposes a language expectation without user opt-in or justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

The documentation instructs users to modify a systemd service and run sudo commands to apply proxy settings globally. Even though this is presented as optional setup guidance, encouraging privileged changes for a market-data skill expands blast radius: misconfiguration could route all gateway traffic through an attacker-controlled proxy or expose secrets and requests from unrelated skills.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
在 gateway 可读到的环境里设置即可，例如 `~/.openclaw/.env` 中加入 `HTTPS_PROXY=...` 和 `HTTP_PROXY=...`。或当前 shell 测试：`export HTTPS_PROXY=http://127.0.0.1:7890` 后执行 `python3 scripts/quote.py AAPL`。

   **可选：systemd 全局**（仅当你用 systemd 跑 gateway 且希望所有请求走代理时）  
   编辑 `/etc/systemd/system/openclaw-gateway.service` 在 `[Service]` 下增加 `Environment=HTTPS_PROXY=...` / `HTTP_PROXY=...`，然后 `sudo systemctl daemon-reload && sudo systemctl restart openclaw-gateway`。注意这会对该服务下所有请求生效。

**可选环境变量**（仅 `quote.py`）：`OPENCLAW_QUOTE_TIMEOUT`（默认 12 秒）、`OPENCLAW_QUOTE_RETRY_DELAY`（单 symbol 顺序时的间隔，默认 0.4 秒）、`OPENCLAW_QUOTE_CACHE_TTL`（结果缓存秒数，0=关闭）。多 symbol 时默认**并行**请求以提升性能，可通过 `OPENCLAW_QUOTE_PARALLEL=0` 关闭；`OPENCLAW_QUOTE_MAX_WORKERS`（默认 6）控制并行度。**失败重试**：`quote.py` 单次 HTTP 请求默认最多重试 2 次（共 3 次），5xx/超时/断线会指数退避；可通过 `OPENCLAW_QUOTE_RETRIES=0` 关闭。`cn_quote.py` 与 `news.py` 同样对单次请求做最多 2 次重试。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script emits user-facing status text in Chinese, including the quote label and failure message, with no option to select another language. This is a natural-language locale policy issue because the skill imposes a specific language on all users without opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring, argparse description, help text, and several user-facing messages are written in Chinese, including mixed Chinese output for both CN/HK and US stock paths. This imposes a specific language on users without offering opt-in, selection, or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The user-facing output includes hardcoded Chinese labels like "涨跌", "成交量", and "52周" while other messages and CLI help are in English. This forces a locale/language choice on users without opt-in or configuration, which matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code presents its user-facing description, argument help, and error/output messages only in Chinese. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation unless a locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.