ClawHub
Back to skill

Security audit

Stock Rumors

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AIsa-powered market rumor scanner, with no hidden persistence or local data access, though users should be careful with its API key and custom endpoint setting.

Install only if you intend to use AIsa for market-rumor scanning. Keep AISA_API_KEY scoped and revocable, and do not set AISA_BASE_URL unless you trust the endpoint receiving authenticated requests.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/rumor_scanner.py:153
Finding

Unrestricted API Base URL Can Expose the AIsa API Key

Content
View full analysis

Vulnerability Details

File Location: scripts/rumor_scanner.py, lines 153–160
Vulnerability Type: Arbitrary authenticated API endpoint configuration
Risk Level: Medium

python
def get_client() -> OpenAI:
    api_key = os.environ.get("AISA_API_KEY")
    if not api_key:
        print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        print("   Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)

Technical Analysis

The program reads AISA_BASE_URL from the environment and passes it directly to the OpenAI client without validating its scheme or hostname. The same client is configured with AISA_API_KEY, so authenticated requests may be directed to any endpoint selected through that environment variable.

Network access to the default https://api.aisa.one/v1 endpoint is declared in SKILL.md and is necessary for the Skill's stated market-scanning functionality. However, allowing an unrestricted endpoint override is not necessary for ordinary operation and weakens least-privilege protections around the credential.

Exploitation requires an attacker to influence the process environment or its launch configuration. This is not a direct remote exploit by itself, and the code does not intentionally place the API key in prompt content or standard output.

Attack Path

  1. An attacker gains the ability to modify the environment, shell profile, service configuration, wrapper script, or task configuration used to launch the Skill.
  2. The attacker sets AISA_BASE_URL to an attacker-controlled API-compatible endpoint.
  3. The user invokes scripts/rumor_scanner.py with a valid AISA_API_KEY.
  4. get_client() constructs an OpenAI client using the legitimate credential and the attacker-selected endpoint. 5 ...[truncated 742 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove AISA_BASE_URL configurability if custom endpoints are not required.
  2. If customization is necessary, parse the URL and require:
    • The https scheme.
    • An explicit allowlist of trusted hostnames.
    • No embedded username or password.
    • An expected path prefix and port.
  3. Disable or strictly validate cross-origin redirects so authorization data cannot be forwarded to an untrusted host.
  4. Do not reuse AISA_API_KEY for arbitrary custom endpoints. Require a separate endpoint-specific credential when a non-default service is selected.
  5. Fail closed when URL parsing or validation fails and avoid printing credentials in errors or diagnostics.
  6. Document the destination receiving the credential and the security implications of endpoint overrides.
  7. Use narrowly scoped, revocable API keys with quota restrictions and rotate any key suspected of exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description is broadly worded around common finance topics like rumors, insider trading, analyst changes, and early market signals, which can cause the skill to trigger for ordinary market-information queries. Over-broad activation increases the chance that the agent invokes this skill unnecessarily, exposing API-backed behavior and environment-backed capabilities in contexts where they were not specifically requested.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 165)May include surrounding context.

python
print("❌ Error: AISA_API_KEY environment variable is not set.", file=sys.stderr)
        print("   Set it with: export AISA_API_KEY=your_key_here", file=sys.stderr)
        sys.exit(1)
    base_url = os.environ.get("AISA_BASE_URL", "https://api.aisa.one/v1")
    return OpenAI(api_key=api_key, base_url=base_url)