ClawHub
Back to skill

Security audit

Moomoo Trading

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for moomoo/Futu trading, but live trading can send the unlock password to any configured OpenD host and the setup check exposes raw financial account identifiers.

Install only if you understand that this skill can trade real securities when explicitly invoked. Keep live trading pointed at a trusted local OpenD instance, avoid remote --host values unless you have a secure authenticated tunnel, protect the unlock-password environment variable, and avoid sharing setup_check.py output because it may include financial account identifiers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/trade.py:28
Finding

Live trading password can be transmitted to an arbitrary OpenD host

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup_check.py:24
Finding

Setup check exposes raw financial account and card identifiers on standard output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes scripts that rely on environment variables, including a live-trading unlock password, but the manifest does not declare any explicit tool scope or permission boundary for environment access. In an agent setting, undeclared env access can expose secrets or enable unintended use of sensitive credentials, which is especially risky here because the skill can place real stock orders.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_moomoo_common.py (reported line 106)May include surrounding context.

python
)

    try:
        return getattr(api.TrdMarket, resolved_market)
    except AttributeError as exc:
        raise ValueError(f"Trade market '{resolved_market}' is not supported by the SDK.") from exc

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/quote.py (reported line 64)May include surrounding context.

python
"K_YEAR",
    ]
    ktype_map = {
        name: getattr(api.KLType, name)
        for name in ktype_names
        if hasattr(api.KLType, name)
    }