A Stock Trader

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:21 AM UTC
• Version: 1.0.1

Overview

This is a disclosed A-share paper-trading skill with local data storage and scripts, but it has implementation weaknesses users should understand before relying on results.

Install only if you are comfortable with a China A-share paper-trading tool that fetches market data from East Money and writes a local SQLite database under ~/.openclaw/workspace/a-stock/. Treat outputs as educational, not investment advice, and be aware that malformed CLI inputs or tampered HTTP market data can corrupt or mislead the simulated results.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backtest.py:26

Finding

SQL Injection in Stock Data Lookup

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/simulate.py:75

Finding

Negative Transaction Values Can Corrupt Simulated Account State

Content

View full analysis

Remediation

View remediation

0) CHECK (cost > 0) CHECK (cash >= 0) ``` 6. Use fixed-point decimal arithmetic or integer currency units instead of binary floating-point values for financial calculations. 7. Add regression tests covering zero, negative, non-finite, extremely large, and non-lot-compliant values. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/fetch_daily.py:58

Finding

Market Data Retrieved over Unencrypted HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill metadata and content describe a broad trading system with fetching, backtesting, and persistent account state, but the manifest does not clearly bind those behaviors to declared resources or permissions. This mismatch makes review and enforcement harder and can hide undeclared side effects such as local state mutation or external network access under an innocuous documentation layer.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes network-based data collection from external finance sites and local SQLite persistence, but it does not declare any explicit tool scope or permissions. Undeclared network and storage capabilities reduce transparency and prevent effective policy enforcement, which can allow a skill to access external data or write local state in ways the host did not authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code parameter comes from CLI input and is interpolated directly into the SQL string with an f-string, making the query vulnerable to SQL injection. An attacker can manipulate the WHERE clause or otherwise alter query behavior, which is especially relevant because this script reads from a local SQLite database in a trading workflow where integrity of backtest inputs matters.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/fetch_daily.py (reported line 99)May include surrounding context.

python

def save_data(conn, data):
    """
    保存数据到数据库 / Save data to database
    使用INSERT OR REPLACE防止重复 / Use INSERT OR REPLACE to avoid duplicates
    """
    c = conn.cursor()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

A language or locale policy violation applies to all file types when the skill effectively forces a specific language without offering a choice or documenting the constraint. This README presents all usage instructions only in Chinese, with no bilingual option or note that the skill is region/language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This is a markdown file, so missing user-facing warnings about actions that could affect user data or system integrity should be flagged when omitted. The section provides buy and sell commands for the simulator but does not explicitly warn that these commands change simulated holdings/balance or clarify that they are non-production paper trades.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

The skill name and description are entirely in Chinese and target A-share trading, but the metadata does not explicitly state that the skill is intended only for Chinese-speaking users or offer any language choice. This can create a locale-policy concern if the broader environment expects skills not to force a language without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description lists broad functions like data scraping, storage, backtesting, and simulated trading, but does not define when the skill should be invoked or what specific requests should trigger it. In a manifest file, the absence of explicit trigger boundaries or examples can make activation overly broad and increase the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Natural-language content throughout the file is primarily Chinese, with English only as secondary inline translation, and there is no indication that users can select a preferred language or that the skill is limited to a Chinese-speaking context. This can conflict with organizational language/locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script's user-facing description and runtime messages are bilingual but centered on a China-specific stock market workflow ('A股' / A-share, East Money) without offering any language or locale selection. Under the stated policy, forcing a specific language or locale without opt-in can be a policy concern when exposed as a general-purpose skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code initializes a database under the user's home directory and saves fetched records into it. Although the behavior is visible in docstrings and a post-action print statement reports saved records, there is no clear pre-action user disclosure at the point of execution that the script will create or modify ~/.openclaw/workspace/a-stock/data.db.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.