ClawHub
Back to skill

Security audit

花花个人基金仓位管家

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated finance-advice purpose, but it ships live-looking private portfolio data and enables broad automatic use, so it should be reviewed before installation.

Install only if you intend to use a Chinese HuahuaDaily mutual-fund advisor and are comfortable with it reading live holdings and retaining local policy/activity history. Before publishing or installing broadly, remove the bundled work/decision-input.json and work/decision-result.json live financial snapshots, disable or tightly constrain implicit invocation, and document the exact tool and storage permissions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
work/decision-input.json:4
Finding

Live Financial and Portfolio Data Included in the Distributed Skill

Content
View full analysis

Vulnerability Details

File Location: work/decision-input.json:4-388; related generated recommendation in work/decision-result.json:140-164
Vulnerability Type: Plaintext sensitive financial data exposure
Risk Level: Medium

Vulnerable Data Snippets

From work/decision-input.json:

json
{
  "context": {
    "schemaVersion": "quant_strategy_context.v2",
    "contextId": "qsc_042cbd1010c782e5de65",
    "asOfDate": "2026-07-23",
    "mode": "live",
    "readyForAnalysis": true,
    "readyForAction": true,
    "portfolio": {
      "holdings": [
        {
          "code": "023299",
          "name": "汇添富中证A500指数增强C",
          "marketValue": 7365.6,
          "weightPct": 40.0689
        }
      ],
      "totalMarketValue": 18382.35
    }
  },
  "policy": {
    "confirmedByUser": true,
    "goals": [
      {
        "plannedContributionCnyPerMonth": 5000,
        "purpose": "长期投资，不作他用"
      }
    ],
    "totalInvestableAssetsCny": 120000
  },
  "cash": {
    "availableCny": 100257.65,
    "source": "user_confirmed"
  }
}

From work/decision-result.json:

json
{
  "totalInvestableAssetsCny": 118640.0,
  "amountCny": 5900.0
}

Technical Analysis

The distributed work artifacts contain a plaintext investment snapshot identified as live and user-confirmed. The disclosed fields include a context identifier, fund names and codes, individual market values and portfolio weights, total portfolio value, pending activity, available cash, planned monthly contributions, total investable assets, risk settings, policy timestamps, and an actionable recommendation.

Although no raw user ID was observed, the context identifier and detailed financial fingerprint may permit correlation or re-identification when combined with information available to another system or party. The exposure also contradicts the project's own instruction in SKILL.md:57 not to place user profiles in a distributable Skill directory.

The issue is a packaging an ...[truncated 1466 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove populated work/decision-input.json and work/decision-result.json files from all distributable packages and repository history where feasible.
  2. Exclude generated working artifacts through source-control and packaging rules, such as adding work/ to .gitignore and the package manifest exclusion list.
  3. Store runtime artifacts outside the Skill directory in a user-scoped state location with restrictive filesystem permissions.
  4. If fixtures are necessary, replace them with clearly synthetic data that cannot correspond to a real investor. Remove live context identifiers, exact holdings, timestamps, cash values, and actionable recommendations.
  5. Add an automated release-time secret and privacy scan that rejects artifacts containing indicators such as:
    • "mode": "live"
    • contextId
    • holdings
    • marketValue
    • availableCny
    • totalInvestableAssetsCny
    • confirmedByUser
    • generated amountCny recommendations
  6. Apply data minimization and retention controls so temporary decision inputs and results are deleted when no longer needed.
  7. Add a continuous-integration test enforcing the instruction in SKILL.md:57 that user profiles and live financial records must never appear in the distributable Skill directory.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a high-level investment advisory/decision skill focused on managing users' fund positions and generating actionable recommendations based on multiple data sources and evidence. The supplied code does not implement any of that core behavior. Instead, it only manages user-confirmed classifications of transaction events and derives turnover/activity statistics for the current month from a ledger. This is a materially different primary purpose: bookkeeping/feature construction for portfolio activity, not investment advice or portfolio takeover. While such activity metrics could be a supporting component in a larger investment system, this chunk on its own lacks the declared advisory behavior and introduces a separate undeclared capability: persistent storage of activity classification events. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

该代码块的文档字符串已明确表明其用途是“Append-only champion/challenger registry; it never runs or tunes strategies.”。从实现看，它只做以下事情：读取/写入用户目录下的 strategy-registry.json 和 strategy-events.jsonl；校验 challenger/evaluation JSON 结构；记录状态为 PROPOSED/EVALUATED/PROMOTED/REJECTED；在满足预设评估门槛且显式 user_confirmed 时推广策略版本；支持 rollback 到历史版本。没有任何基金、持仓、研究报告、行情、回测、组合优化、调仓建议、现金流约束建模或对话式投顾逻辑。虽然“策略自进化/版本化/可审计”在高层语义上与版本治理略有相关，但该代码的主要目的和实际能力仅是策略注册与审计控制，远不足以支撑所声明的投资管理技能，因此构成明显描述-行为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs the agent to use broad capabilities including local file reads/writes, Python script execution, and network-backed research/tooling, but the manifest shown in SKILL.md does not declare any explicit tool allowlist or permission scope. In a high-stakes finance workflow, missing scope boundaries increases the chance of unintended file access, data persistence, or over-broad tool use, especially because the skill handles user identifiers, policy state, transaction classification, and report generation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest allows implicit invocation with no narrowly defined trigger constraints, so the skill may be invoked automatically in contexts where the user did not clearly intend portfolio-management advice. Because this skill handles sensitive financial recommendations and can suggest concrete buy/sell/rebalance actions, unintended activation increases the risk of unauthorized or mis-scoped investment guidance based on private holdings or ambiguous prompts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The output template and presentation rules are written as mandatory user-visible formatting requirements in Chinese, including exact phrasing for recommendations and fund display conventions. There is no indication that users may choose another language or locale, so this imposes a language preference without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document forces a specific language for all instructions and operational guidance, which can violate language/locale policy when no user opt-in or alternative language support is provided. There is no indication that this skill is intentionally restricted to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L329 states that output aimed at users '必须翻译为' specific Chinese phrases. This imposes a fixed language requirement in natural-language instructions and does not indicate that the user can choose another language or that the constraint is limited to a justified region-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains all user-facing instructions in Chinese and does not state that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file uses Chinese throughout, including headings, instructions, and examples, but does not state that the skill is China-specific or that users may choose another language. Under the policy-violation rule, forcing a specific language without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file is entirely written in Chinese and does not indicate that language selection is optional or that the skill is limited to a Chinese-only, region-specific use case. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file is written entirely in Chinese and presents user-facing policy/preferences without any indication that language selection is optional. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document requires that user-visible content be translated into natural Chinese and explicitly forbids showing original English enums in the investor-facing report. This is a natural-language locale constraint with no user opt-in or stated region-specific justification, which violates the language/locale policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L010 states that main copy '必须中文化' and forbids user-visible unexplained internal terms, which imposes a fixed language requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which this file does not provide.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The entire protocol is written as a mandatory operating specification in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/activity_store.py (reported line 263)May include surrounding context.

python
as_of_date=args.as_of_date,
            total_assets_cny=args.total_assets_cny,
        )
    json.dump(result, fp=__import__("sys").stdout, ensure_ascii=False, indent=2, sort_keys=True)
    print()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The next_question function returns multiple user-facing questions entirely in Chinese, which forces a specific language for interaction. Under the policy, locale or language must not be imposed without explicit user opt-in or a clearly documented region-specific justification, and neither is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file embeds extensive user-facing copy exclusively in Chinese, including blocker messages, headings, labels, and explanatory text. Under the language/locale policy, forcing a specific language in user-visible output without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This Python file hard-codes Asia/Shanghai as the default market timezone, and later applies it broadly in execution-window and context normalization logic. Under the policy, forcing a specific locale without user choice or an explicit documented region-specific constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function advertises cadence control using last_signal_date, but the implementation calls datetime.datetime.strptime even though only datetime was imported from the datetime module. That raises an exception, is swallowed, and silently disables the frequency gate, making should_trade remain true even when recent trades should block another action. In an investment-execution skill, this can systematically increase trade frequency and undermine documented risk controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring says this component is an append-only registry that never runs or tunes strategies. However, the code performs state-changing strategy governance actions such as bootstrapping, promoting, rejecting, and rolling back champion versions, which goes beyond a purely append-only registry and directly affects which strategy is active.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This JSON file contains multiple user-facing natural-language fields such as titles, facts, inferences, unknowns, and the no-trade rationale entirely in Chinese. There is no accompanying field indicating that the user selected Chinese or that the skill is intentionally limited to a Chinese-language or China-region context, so the file appears to enforce a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTML document declares lang="zh-CN", and the visible UI strings throughout the template are all in Simplified Chinese. This imposes a specific language/locale on users without any indication that they can choose another language, which matches the policy category for language or locale constraints without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.