ClawHub
Back to skill

Security audit

HuaHuaDailyMCP

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed HuahuaDaily financial-data MCP skill with sensitive access, but its capabilities are coherent with its purpose and guarded by documented token and confirmation boundaries.

Install only if you trust HuahuaDaily with your Agent Token and financial data. Use the narrowest token scopes available, revoke the token when no longer needed, provide screenshot paths only when you intend them to be uploaded for recognition, and review direct community/report actions before allowing the agent to call them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill describes use of environment-provided credentials (`HUAHUA_AGENT_TOKEN`) and extensive networked MCP operations, but it does not declare permissions or capability requirements in a machine-readable way. This creates a trust and consent gap: hosts or reviewers may not realize the skill can access secrets and perform authenticated remote actions, increasing the chance of over-privileged execution or accidental approval.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The function normalizes user-supplied local image files and uploads them to a remote API endpoint for screenshot recognition, but there is no built-in user-facing disclosure or consent step at the point of transfer. Because screenshots of holdings/watchlists can contain sensitive financial data and potentially unrelated personal information, an agent could exfiltrate local content to the service without the user clearly understanding that a remote upload will occur.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This transaction screenshot import path also uploads local images to a remote endpoint without any explicit disclosure or confirmation in the function behavior. Transaction screenshots are particularly sensitive because they can reveal financial history, account details, and trading activity, so silent remote transfer creates a meaningful privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The get_raw_sync_data function returns the complete cloud-synced portfolio payload, including funds, groups, watchlists, tags, and optionally the raw json_data blob, after only checking for a token. This exposes highly sensitive financial and behavioral data with no in-function requirement for explicit user confirmation, data minimization, or prominent runtime warning, making accidental over-disclosure by an agent much more likely.

Unpinned Dependencies

Low
Category
Supply Chain
Content
mcp[cli]>=1.0.0
httpx>=0.27.0
pydantic>=2.0.0
Confidence
91% confidence
Finding
httpx>=0.27.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
mcp[cli]>=1.0.0
httpx>=0.27.0
pydantic>=2.0.0
Confidence
95% confidence
Finding
pydantic>=2.0.0

Known Vulnerable Dependency: mcp — 10 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
mcp

Known Vulnerable Dependency: httpx — 2 advisory(ies): CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)

Critical
Category
Supply Chain
Confidence
84% confidence
Finding
httpx

Known Vulnerable Dependency: pydantic — 4 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more

High
Category
Supply Chain
Confidence
75% confidence
Finding
pydantic

Known Vulnerable Dependency: mcp==1.0.0 — 10 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to ) +7 more

High
Category
Supply Chain
Confidence
87% confidence
Finding
mcp==1.0.0

Known Vulnerable Dependency: pydantic==2.0.0 — 2 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2024-3772 (Pydantic regular expression denial of service)

High
Category
Supply Chain
Confidence
96% confidence
Finding
pydantic==2.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.