Security audit
my-stock-longbridge-skill
Security checks for vulnerabilities and agentic risk
Overview
The skill's purpose (Longbridge trading integration) matches the code, but there are clear incoherences and unsafe practices — notably hardcoded API credentials in multiple files, an undeclared dependence on the openclaw CLI, and a detected prompt-injection pattern in SKILL.md.
Do not install or run this skill as-is. The code contains hardcoded Longbridge API credentials and an access token embedded in multiple files — secrets should never be committed into skill source. Ask the author to: (1) remove all hardcoded credentials and require credentials be supplied via the platform's secret store or documented env vars; (2) declare the openclaw CLI dependency (or remove subprocess-based message sending) and document the TARGET_USER/ACCOUNT_ID behavior and privacy implications; (3) explain and remove any hidden/obfuscated content that triggered the base64-block scan; (4) provide a clear install spec and minimize permissions. If you already used the included credentials anywhere, rotate them immediately. Only proceed after those fixes and after reviewing network endpoints and who receives outbound messages.
SkillSpector findings are pending for this release.