Security audit

Hk Financial Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Hong Kong financial-report downloader, but it needs review because unsafe validation can write outside its intended archive and fetch unexpected PDF URLs.

Install only if you are comfortable reviewing or fixing the Python script first. At minimum, restrict stock codes to numeric HK symbols, verify all write paths remain inside the archive, allowlist PDF download hosts, and add download size limits before using --pdf.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/hk_downloader.py:512
Finding: Path Traversal Through an Unvalidated Stock Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/hk_downloader.py:400
Finding: Server-Side Request Forgery Through Unrestricted Remote PDF URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/hk_downloader.py:407
Finding: Unbounded Response Buffering Permits Memory Exhaustion
Content: View full analysis
Remediation: View remediation
MAX_PDF_SIZE: raise ValueError("PDF exceeds maximum permitted size") output.write(chunk) ``` 4. Validate the initial `%PDF` signature as soon as the first chunk is received. 5. Write to a securely created temporary file in the intended destination, then atomically rename it only after validation succeeds. Delete partial files on every failure path. 6. Configure process-level memory and execution limits as defense in depth. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description is mostly aligned with the overall intent: this is indeed a Hong Kong financial report downloader, it classifies annual/interim/quarterly/prospectus documents, prefers complete reports over earnings announcements, and can download PDFs. However, there is a material mismatch in the declared source coverage. The description says it automatically obtains reports from Eastmoney/Tonghuashun/HKEX, but the HKEX path is explicitly stubbed out: fetch_hkex does not perform retrieval and always returns an empty list after a stockId lookup attempt. That means one of the three named data sources is not actually implemented, so the declared behavior overstates the skill's real capability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly describes network access and writing downloaded PDFs/manifests to disk, but it does not declare any explicit tool scope or permissions. In agent environments, missing scope declarations weaken user awareness and policy enforcement, making it easier for a seemingly simple skill to perform broader side effects than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description is entirely Chinese and the HKEX API example hard-codes lang: ZH, indicating a fixed language/locale behavior. The file does not offer users a language option or explain that the Chinese locale is required for a justified region-specific reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language/config content specifies lang: ZH for HKEX lookups, which enforces a locale choice. Under the stated policy, fixed language behavior should either be optional for the user or clearly justified as necessary for a region-specific compliance/tooling context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
md
HEADERS_EASTMONEY = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Referer": "https://data.eastmoney.com/notices/", } HEADERS_10JQKA = {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/hk_downloader.py (reported line 26)May include surrounding context.
python
HEADERS_EASTMONEY = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Referer": "https://data.eastmoney.com/notices/", } HEADERS_10JQKA = {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs multiple local filesystem writes when --pdf is used: it creates directories, saves downloaded PDF files, and writes a manifest.json. Although the --pdf flag implies downloading, the script does not include any explicit warning, confirmation, or descriptive disclosure that these operations will write under /root/.openclaw/workspace/archive and modify local storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill documents that it will download PDFs and write them plus a manifest into a workspace archive, but it does not prominently warn users about these filesystem changes before execution. In agent settings, undisclosed file creation can surprise users, consume storage, and overwrite or clutter expected directories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Natural-language strings in the module description and CLI help are presented only in Chinese, which can amount to forcing a specific language without user opt-in. There is no indication that the tool is region-specific or that users can select an alternate language/locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.