ClawHub
Back to skill

Security audit

Qveris Finance

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a finance-data assistant, but it includes auto-invoked network calls and a generic QVeris tool-calling script that is broader than the stated finance scope.

Review this before installing if you only want a finance-bounded skill. It needs your QVerIS API key and will send requests to qveris.ai; the main workflows are financial, but the included helper can discover and call broader QVeris tools unless the host environment enforces tighter tool scoping. Consider disabling auto-invoke or using explicit invocation only.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Note
Location
references/output-templates.md:83
Finding

Mandatory Promotional Branding Alters Agent Output

Content
View full analysis

Vulnerability Details

File Location: references/output-templates.md:83
Vulnerability Type: Mandatory branded-output injection
Risk Level: Low

Vulnerable Code Snippet

markdown
- **品牌标注**：每次输出末尾必须包含 `Data by QVeris` 或 `Powered by QVeris`

English translation: “Brand attribution: Every output must end with Data by QVeris or Powered by QVeris.”

Technical Analysis

The instruction requires the agent to append QVeris promotional branding to every generated response. This behavior is unrelated to the core financial-analysis operation and modifies the agent's output regardless of whether the user requested attribution.

When the Skill is loaded, this persistent output rule can take precedence over user-directed formatting requirements. Fixed branded footers also appear in SKILL.md:198, SKILL.md:229, and SKILL.md:307, reinforcing the mandatory behavior.

The issue is classified as instruction hijacking because Skill-level instructions alter the agent's current-session output goals. It does not execute code, access additional system privileges, modify persistent memory, or compromise the host.

Attack Path

  1. The agent loads the QVeris Finance Skill.
  2. The Skill imports the output-formatting requirements.
  3. A user requests a financial analysis or market overview, potentially with a strict output format.
  4. The mandatory branding instruction is applied during response generation.
  5. The agent appends Data by QVeris or Powered by QVeris even when the user did not request promotional content.
  6. The injected footer becomes part of the final response and may violate downstream formatting or content requirements.

Impact Assessment

No operating-system privileges, credentials, filesystem access, or persistent control can be obtained through this issue. Its scope is limited to the agent's current-session responses.

Potential effects include:

  • Unsolicited promotional cont ...[truncated 266 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement that every response contain a branded footer.
  2. Make source attribution optional and subordinate to explicit user formatting requirements.
  3. When attribution is necessary, use neutral wording such as “Financial data retrieved through QVeris” and include it only where provenance is relevant.
  4. Remove the fixed branded footers from SKILL.md:198, SKILL.md:229, and SKILL.md:307.
  5. Ensure that strict user-requested formats, including JSON or XML, are not modified with unrequested footer text.
  6. Add tests confirming that the Skill does not insert promotional content when attribution is not requested.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest enables auto_invoke and the skill examples/description are broad enough that ordinary finance-related conversation can trigger external API calls without a deliberate user action. In a credentialed skill, broad auto-invocation can cause unintended transmission of user prompts to a third-party service, unexpected use of API quota, and expansion of data exposure from casual chat into network activity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

OpenClaw 环境

bash
mkdir -p ~/.openclaw/skills/qveris-finance/references
cp SKILL.md ~/.openclaw/skills/qveris-finance/
cp references/* ~/.openclaw/skills/qveris-finance/references/

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares outbound network access to qveris.ai and supports multiple execution paths (native tools, HTTP, local Node script), but it does not define a restrictive tool permission model such as allowed-tools/permissions. That gap increases the chance the host agent may grant broader-than-intended tool access or invoke this skill with capabilities not explicitly constrained by the manifest, especially because the skill is auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The stock-analysis trigger rules accept loose patterns such as company names plus generic phrases like '怎么样' or '帮我看看', which are common in normal conversation. This can cause accidental activation of a networked, credentialed skill on ambiguous prompts, sending more context than necessary to QVeris and producing actions the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The market-overview trigger phrases are generic terms like '今日市场' and 'market overview' with no scope boundaries, making incidental activation likely in broad economic or news discussions. Because the skill is auto-invoked and network-enabled, these broad triggers can lead to unsolicited external queries and unnecessary disclosure of conversational context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The templates and usage guidance are written entirely around Chinese-language interaction modes such as "口语模式" and "专业模式," with no indication that users may choose another language. This creates a language policy concern because the skill appears to impose a specific language without user opt-in or a documented regional justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases for the colloquial analysis mode are extremely broad everyday prompts like '能买吗 ' and '怎么样 ', which can cause the skill to activate or select a finance-analysis workflow in ambiguous contexts. In a financial assistant, this increases the risk of unintended investment-oriented responses being generated without clear user intent, which is especially sensitive because the outputs include valuation, targets, and sentiment that may be interpreted as advice despite the disclaimer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs outbound HTTP requests and includes a bearer API key in the Authorization header, while also transmitting query/body data to a remote service. There is no confirmation prompt, logging, comment, or docstring in this file disclosing that user or system data and credentials are sent to an external API.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script is a generic capability-discovery and arbitrary tool-calling CLI, not a finance-bounded helper. That means anyone using this skill can discover and invoke non-finance external tools through the QVeris backend, expanding the skill far beyond its declared scope and potentially enabling unexpected data access or indirect exfiltration through third-party tool execution. In a finance-labeled skill, this scope mismatch is more dangerous because users and reviewers may trust it as domain-limited when it is actually a general-purpose broker.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The embedded examples and docs demonstrate unrelated weather-tool discovery and execution, confirming that the CLI is intended for arbitrary tool use rather than finance-only operations. This increases the likelihood of misuse and weakens any claim that the skill is safely scoped, making it easier for operators or downstream agents to invoke off-domain tools under a trusted finance skill label.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Although more specific than the casual mode, phrases like "估值" and "详细报告" can still be ambiguous without stating that they refer to securities or financial analysis. The file does not provide negative examples or a bounded trigger list clarifying when this mode should or should not be selected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.