ClawHub
Back to skill

Security audit

HuaHuaDailyMCP

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its HuahuaDaily finance purpose, but it handles sensitive portfolio/account tokens and includes under-scoped local file submission plus mutable remote install instructions.

Install only from a pinned, reviewed release or commit, use a narrowly scoped Huahua Agent Token, prefer the remote official MCP or core profile where possible, and do not let an agent pass arbitrary local JSON files to the report-submit CLI unless you have reviewed the contents and destination.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (54)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

curl ... | sh (and the PowerShell iex equivalent) is a classic arbitrary-code execution pattern because it streams remote content directly into a shell without review or integrity checks. If the remote source is altered, users immediately execute attacker-controlled code, which can steal tokens, modify MCP behavior, or persist malware on the host.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

bash
# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
94% confidence
Finding

The README recommends pip install git+https://github.com/..., which installs and executes package build/install logic from a live remote repository rather than a pinned, immutable release artifact. This exposes users to repository compromise, force-pushed changes, malicious dependency updates, or unsafe build hooks during installation.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

y": { "command": "uvx", "args": [ "--from", "git+https://github.com/baiye1997/HuaHuaDailyMCP", "huahua-daily" ], "env": { "HUAHUA_API_BASE": "https://api.huahuadaily.cn", "HUAHUA_AGENT_TOKEN": "粘贴你的 Agent Token" } } } }

text

### 方式三：pip 安装

如果不想安装 uv，可以用 pip 全局安装：

```bash
pip install git+https://github.com/baiye1997/HuaHuaDailyMCP

MCP 配置：

json
{
  "mcpServers": {
    "huahua-daily": {
      "command": "huahua-daily",
      "env": {
        "HUAHUA_AGENT_TOKEN": "粘贴你的 Agent Token"
      }
    }
  }
}

方式四：本地运行

bash
# 克隆仓库
git clone https://github.com/baiye1997/HuaHuaDailyMCP.git
cd HuaHuaDailyMCP

# 安装依赖
pip install -r requirements.txt

# 运行
HUAHUA_AGENT_TOKEN=你的Token python server.py

HuahuaDaily 主仓库联调使用工作区 MCP，避免调用已安装的生产版本。启动�

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The provided code is a narrow internal validation/helper module. It does not access external data sources, perform user-facing fund analysis, handle trades, imports, images, exports, or CLI interactions. Instead, it checks whether an input dictionary contains sufficient and fresh estimate-related fields from approved sources. That is materially different from the declared broad skill purpose, so this chunk does not accurately represent the described functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

该代码块的主要行为与声明中的一部分相符：它确实用于基金查询、行情、历史、费率、业绩排名和量化分析，也包含部分持仓/画像信息查询。因此“查询和分析基金数据”这一主线基本成立。 但声明还明确提到可“创建需要用户在 App 内确认的交易或批量导入请求”，而代码中没有任何下单、交易申请、定投创建、导入任务创建等写操作接口；出现的 POST 仅用于批量查询画像、费率、量化等读取型请求，不构成交易或导入创建能力。 此外，声明提到“社区数据”，代码中也没有任何社区帖子、讨论、评论、情绪或社群内容相关 API。 因此这是“描述大于实际能力”的不准确描述：并非代码存在未声明的危险能力，而是声明声称了交易/导入/社区等代码未体现的能力，属于描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description emphasizes data query/analysis across financial and community domains plus creating trade or batch import requests requiring in-app confirmation. This code instead implements a narrowly scoped write action: saving a user-owned strategy report. That is a materially different primary purpose and an undeclared capability. While both are within the broader Huahua ecosystem, the actual behavior does not match the described querying, analysis, trading, or import-request functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description focuses on financial data querying/analysis and creating trade or import requests. The supplied code does not implement those business functions. Instead, it provides system-level support and unrelated product/account metadata access: authentication token setup, MCP/tool manifest discovery, backend compatibility checks for quant/agent-import schemas, current user lookup, and app version queries. While quant compatibility checking is loosely adjacent to the broader product domain, the primary behavior here is administrative/runtime introspection rather than fund holdings,行情,交易,量化 analysis, community data access, or transaction/import request creation. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code chunk does not implement the declared business functionality around querying fund holdings,行情, trades, quant/community data, or creating App-confirmed trade/import requests. Its primary purpose is operational infrastructure: checking whether the MCP runtime itself has an available update by making an HTTP request to a version source, parsing a version string, caching the result, and logging warnings at startup. That is a materially different purpose and includes undeclared outbound network behavior. This is not merely a supporting implementation detail for the declared capability; it is an unrelated maintenance/update subsystem.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about querying/analyzing HuahuaDaily financial data and creating App-confirmed trade/import requests. The actual code shown does not implement any of those capabilities, nor does it access relevant data or create requests. Instead, it serves a separate maintenance/support purpose: exposing the package version and where to fetch updates, plus upgrade instructions. This is a materially different primary purpose from the declared skill behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

_submit_report accepts any user-supplied path, loads the JSON object, and sends it directly to a remote endpoint with no schema restriction, path restriction, content allowlist, or confirmation gate. In a local-agent context this creates a clear exfiltration primitive: any readable JSON file in the user environment, including exports, credentials, app data, or other sensitive artifacts, can be transmitted off-host under the guise of a report submission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该技能的自然语言说明从标题开始即完全以中文呈现，且文档中未说明这是面向特定中文地区用户的区域性技能，也未提供其他语言选项或用户选择机制。按规则，强制特定语言而无用户选择或明确、合理的地域限制说明，属于语言/locale 政策风险。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to launch the MCP server directly from a Git repository via uvx --from git+https://... without pinning to a specific commit or release. That creates a supply-chain risk: anyone who can modify the repo, a dependency, or the fetched ref can change what code is executed the next time a user installs or runs the tool.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This is another unpinned uvx --from git+https://... example, which again causes users to execute whatever code is currently served by the remote repository. In a security-sensitive MCP that handles agent tokens and sensitive portfolio data, unpinned remote execution materially increases the chance of supply-chain compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises operational capabilities involving environment tokens, local files via CLI, and remote MCP/HTTP access, but it does not declare an explicit tool/permission scope. That weakens least-privilege guarantees and makes it harder for a host to constrain what the skill may access, increasing the risk of unintended token exposure, filesystem access, or network use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill description and operational instructions are written only in Chinese, and there is no statement offering multilingual support, user language selection, or explaining that the skill is intentionally limited to a Chinese-only regional context. Under the policy rule, a skill that effectively mandates one language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural-language strings in Chinese, starting with the parser error message at L030 and continuing throughout the CLI help and status text. The skill does not appear to offer user opt-in for language selection or document that it is intentionally limited to a Chinese-speaking region, which conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI exposes a report submit path that reads an arbitrary local JSON file and POSTs it to /api/agent/messages, which is outside the manifest’s described scope of fund analysis, imports, and user-confirmed trading/import requests. In an agent setting, undocumented outbound submission features materially expand the data-exfiltration surface because a model or workflow may invoke them on unrelated local files without the user understanding that this capability exists.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module raises multiple user-visible exceptions entirely in Chinese, such as token setup and network/authentication errors, with no indication that the skill is intentionally Chinese-only or that users can opt into another language. This creates a language/locale policy issue because the skill effectively forces one language on all users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code performs multiple outbound HTTP operations, including authenticated GET/POST/PUT/DELETE requests and file uploads, using an AgentToken header derived from environment or request context. Although the module docstring mentions HTTP transport, there is no confirmation prompt, user-facing log/print, or inline warning disclosing that user data and credentials may be sent to a remote backend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The raised RuntimeError messages are hard-coded in Chinese (并发估值请求过多，请稍后重试 and Agent Token 已在请求期间变更，请重试). This imposes a specific language on users without offering a locale choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The function docstring is written entirely in Chinese, and multiple manifest fields in the returned structure also use Chinese-only natural-language descriptions. This indicates a language-specific skill surface without any visible opt-in, locale negotiation, or justification that the skill is region-limited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits a hard-coded Chinese error message when view validation fails. Because the rule applies to all file types and flags language policy violations, forcing one language in user-facing text without offering a language choice or documented locale constraint is a policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The raised ValueError messages for invalid dates are hard-coded in Chinese and appear intended for end users or callers. There is no indication in this file that users can select a preferred language or that the tool is explicitly scoped to a Chinese-language environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The main validator contains numerous hard-coded Chinese error strings for schema, type, and business-rule failures. This creates a consistent forced-language behavior without any visible opt-in, fallback, or justification for restricting responses to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code contains natural-language instructions and descriptions exclusively in Chinese across tool docstrings, which can amount to a language policy violation when no user language choice or locale constraint is offered. The file does not document that the skill is intentionally region-specific or limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This Python file contains multiple user-facing natural-language strings exclusively in Chinese, including validation errors, docstrings, and next-step messages. Because the file does not offer any language/locale choice or document a justified locale restriction, it appears to impose a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.