snowtrace

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:09 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent as a Xueqiu investment-summary scraper, but it asks users to provide a live browser session cookie and uses stealth browser automation to pass WAF protections.

Install only if you are comfortable giving the agent a live Xueqiu browser-session cookie and letting it perform authenticated scraping with stealth browser automation. Use a dedicated low-privilege account if possible, avoid pasting the token into shell history or chats, rotate the token if exposed, and run installation in a contained environment because it downloads npm packages and Chromium without a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:54
• Finding: Mutable Dependencies and Browser Artifacts Are Installed Without a Lockfile or Integrity Verification## Vulnerability Details **File Location**: `install.sh:54-62`; related dependency declarations at `package.json:12-15` and installation instructions at `SKILL.md:53` **Vulnerability Type**: Supply-chain exposure through mutable dependency resolution **Risk Level**: Medium **Vulnerable code (`install.sh:54-62`):** ```bash # 3. Install npm packages locally in the skill directory echo "==> Installing npm dependencies..." cd "$SCRIPT_DIR" [ ! -f package.json ] && npm init -y --silent npm install --save playwright-extra puppeteer-extra-plugin-stealth 2>&1 | tail -3 # 4. Install Chromium browser echo "==> Downloading Chromium..." npx playwright install chromium 2>&1 | tail -5 ``` **Related dependency declarations (`package.json:12-15`):** ```json "dependencies": { "playwright-extra": "^4.3.6", "puppeteer-extra-plugin-stealth": "^2.11.2" } ``` ### Technical Analysis The project does not include a package lockfile, and its dependencies use caret version ranges. Consequently, each installation can resolve package versions that differ from those reviewed during the audit. The installation script also invokes `npm install` directly and executes `npx playwright install chromium`, retrieving packages and browser artifacts from external infrastructure at installation time. npm packages may execute lifecycle scripts during installation. If an allowed dependency release, transitive dependency, npm account, registry response, or downloaded browser artifact is compromised, attacker-controlled content could execute under the privileges of the user running `install.sh`. The script invokes `apt-get`, `apk`, or `yum` without privilege dropping. In container or administrative environments, it may therefore be run as root, increasing the impact of a supply-chain compromise. No evidence was found that the currently declared packages are malicious; the vulnerability is the mutable and insufficiently verified in ...[truncated 1398 chars]
• Remediation: ## Remediation Suggestions 1. Pin all direct dependencies to reviewed exact versions rather than caret ranges. 2. Generate, review, and commit a `package-lock.json`, then replace `npm install` with `npm ci`. 3. Explicitly declare every package used by `npx`, including the appropriate Playwright package, and invoke its local binary instead of allowing `npx` to resolve missing packages dynamically. 4. Use `npm ci --ignore-scripts` where dependency functionality permits it. If lifecycle scripts are required, explicitly audit and allow only the necessary scripts. 5. Verify downloaded browser artifacts using publisher-provided cryptographic checksums or signatures. 6. Run dependency and browser installation as a dedicated unprivileged account. Separate privileged operating-system package installation into a reviewed administrative step. 7. Add automated dependency review, vulnerability scanning, and lockfile-integrity checks to the release process. 8. Avoid modifying dependency declarations during installation by removing `--save` from runtime setup scripts.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:167
• Finding: Authentication Token Is Passed in a Command-Line Cookie Argument## Vulnerability Details **File Location**: `SKILL.md:167-174` **Vulnerability Type**: Sensitive credential exposure through shell history and process arguments **Risk Level**: Medium **Vulnerable documentation and command:** ```bash ### 4. Supplement: Single-stock quote fallback using curl The quote subdomain has no WAF and can be called directly with curl: curl -s -b 'xq_a_token=TOKEN' -H 'User-Agent: Mozilla/5.0' -H 'Referer: https://xueqiu.com/' \ 'https://stock.xueqiu.com/v5/stock/quote.json?symbol={symbol}&extend=detail' \ | jq '.data.quote | {symbol, name, current, percent, chg, high, low, pe_ttm, pb, dividend_yield, last_close}' ``` ### Technical Analysis The documented fallback instructs the user or Agent to place the Xueqiu authentication token directly in curl's `-b` command-line argument. When `TOKEN` is replaced with the real credential, the value may be recorded in interactive shell history, terminal transcripts, command telemetry, diagnostic logs, or process-auditing systems. On systems where process arguments are visible to other users, the credential may also be observable through process inspection while curl is running. The API reference states that the token can remain valid for weeks or months, increasing the useful exploitation window after disclosure. Sending the token over HTTPS to `stock.xueqiu.com` is consistent with the Skill's declared authenticated quote functionality and is not unrelated exfiltration. The vulnerability concerns how the secret is supplied to curl, rather than the intended first-party network destination. ### Attack Path 1. The user replaces the `TOKEN` placeholder with a valid `xq_a_token` value and runs the documented command. 2. The complete command is retained in shell history, terminal capture, process accounting, or monitoring logs, or is observed from the process argument list during execution. 3. A local user, support operator, log reader, malware process, ...[truncated 824 chars]
• Remediation: ## Remediation Suggestions 1. Do not place the token directly in a command-line argument. 2. Store the cookie in a temporary cookie file with permissions restricted to the current user, such as mode `0600`, and pass the file path to curl. 3. Create the file using a secure temporary-file facility, avoid predictable paths, and delete it immediately after use with cleanup enforced by a shell trap. 4. Ensure the token is not printed to stdout, stderr, debug logs, or generated reports. 5. If a temporary file is unsuitable, use a small helper that reads the token from a protected environment variable and constructs the HTTP request without exposing the value in the process argument list. 6. Warn users to revoke and regenerate any token previously entered directly into shell history and to remove affected history or logs where feasible. 7. Prefer the existing browser-context implementation, which reads `XQ_A_TOKEN` from the environment and does not include its value in command-line arguments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Ssd 3

High

• Confidence: 98% confidence
• Finding: This README explicitly instructs users to retrieve an authenticated session token from browser cookies and provide it to the skill. Session-cookie reuse is dangerous because it transfers a credential meant for an interactive browser session into an automation environment, where it may be exfiltrated, reused, or abused for unauthorized account access. The surrounding skill context makes this more dangerous: the project uses Playwright with stealth/WAF bypass language and broad agent execution, so a stolen token could be combined with automated scraping to access account-associated data at scale.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill description presents a benign summarization/investment-assistant workflow, but the implementation instructions explicitly include Playwright Stealth and homepage navigation to 'pass' or bypass WAF protections. This hidden evasion capability materially changes the risk profile because it encourages anti-bot circumvention and collection behavior that users and platform operators may not reasonably expect from the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code explicitly advertises and implements WAF bypass behavior using Playwright plus a stealth plugin, then seeds authentication cookies to access Xueqiu endpoints. That combination meaningfully increases abuse potential by automating access controls evasion and authenticated scraping beyond the skill’s stated business need of summarizing posts and watchlist quotes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence
• Finding: The README tells users to run `npx playwright install chromium` without pinning the Playwright package version. That can pull whatever version is current in the environment or registry context, which weakens supply-chain reproducibility and can expose users to unexpected or compromised package contents. In a skill intended for automated agent environments, unpinned install steps increase risk because execution may happen with limited human review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to extract a live `xq_a_token` from browser cookies and export it for the skill, but does not clearly emphasize that this is a sensitive session credential with privacy and account-security implications. This encourages users to hand an authenticated token to an agent-integrated workflow, increasing the chance of credential leakage through logs, shell history, process environments, or downstream tool misuse. In this context, the token likely grants access to account-linked data such as watchlists and personalized content, making the exposure materially sensitive.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README says the agent will 'automatically recognize this skill and execute data grabbing and analysis' without defining narrow trigger conditions or requiring explicit user confirmation. Broad activation language is risky for agentic systems because it can cause the skill to run in unintended contexts, including contexts where stored credentials or browser-backed sessions are available. Given this skill performs authenticated scraping and investment-related processing, accidental invocation is more dangerous than for a passive read-only utility.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires environment access for `XQ_A_TOKEN` and unrestricted network access to Xueqiu endpoints, but it does not declare any explicit tool scope or permissions boundary. In practice this creates an over-privileged integration surface: a runtime may grant broader capabilities than users expect, making secret handling and outbound requests less transparent and harder to govern.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill handles a session-like token, account watchlist contents, and optional portfolio holdings/cost basis, all of which are sensitive financial and account-linked data, yet it provides no explicit privacy or retention warning. This increases the chance that users disclose secrets and holdings without understanding the sensitivity, and it weakens informed consent around how financial data is accessed and processed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: Using `npx playwright` without pinning an exact version makes the installation non-reproducible and exposes the skill to supply-chain risk if a newer or compromised package version is fetched at execution time. Because this step installs and runs code from the network, an attacker controlling dependency resolution or an upstream package compromise could execute arbitrary code in the user's environment.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The browser context is hard-coded to use locale 'zh-CN' and timezone 'Asia/Shanghai'. This enforces a specific language/locale behavior for all users without offering a choice or documenting an opt-in, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script's user-facing comments and status messages are written in Chinese, which imposes a specific language on users without any opt-in or explanation of a region-specific requirement. Under the policy, fixed language/locale behavior should either provide a choice or be clearly justified.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This shell script installs system packages with apt/apk/yum and creates or modifies local project files via npm initialization and dependency installation. Although it prints progress messages, it does not clearly warn the user up front that it will change the system/container state, install software from the network, and write files into the skill directory.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The script invokes `npx playwright install chromium` without pinning the Playwright package version to a known-good release. If the local dependency tree is absent, altered, or unexpectedly resolved from the registry, the install path may fetch or execute code from an unintended version, reducing supply-chain integrity during installation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The manifest description is entirely in Chinese and describes a Chinese-market investment summary skill, but it does not indicate that users may choose another language or that the locale restriction is optional. This can violate language/locale policy if the skill is presented in a broader environment without explicit user opt-in to Chinese-only behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to extract an authentication cookie (`xq_a_token`) from their browser and export it into a shell environment, but it does not warn that this token is a bearer credential tied to the user account. In the context of an unofficial reverse-engineered API, this increases the risk of credential leakage via shell history, logs, screenshots, copied terminal output, or reuse in insecure tooling, potentially enabling account misuse or unauthorized access to private capabilities associated with the session.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The instruction `所有输出使用**中文**` imposes a fixed language requirement. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; this file does neither.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: This is a manifest file, so vague-trigger checks apply. The description only states the skill's function in broad terms and does not define specific invocation phrases, scope limits, or exclusion conditions, which can make activation criteria ambiguous in systems that infer triggers from manifest text.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"keywords": ["openclaw", "skill", "xueqiu", "stock", "investment"],
  "license": "MIT",
  "dependencies": {
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

• Confidence: 95% confidence
• Finding: Using caret ranges for security-sensitive browser automation dependencies allows newer upstream releases to be installed without review, which increases supply-chain risk. In this skill, the risk is heightened because playwright-extra and stealth plugins interact with browser automation and anti-detection behavior, so a compromised or breaking release could affect scraping behavior or execute malicious install/runtime code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "playwright-extra": "^4.3.6",
    "puppeteer-extra-plugin-stealth": "^2.11.2"
  }
}

• Confidence: 96% confidence
• Finding: The unpinned puppeteer-extra-plugin-stealth dependency introduces supply-chain exposure because future compatible versions may be fetched automatically. This is more concerning in context because stealth plugins are often used to evade detection during automated browsing, making them high-risk dependencies whose updates should be explicitly reviewed before adoption.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This JSON includes company names in Chinese for multiple markets, including a US listing, which imposes a specific language/locale in user-facing data without any indication that the user chose that locale. The policy requires flagging language or locale constraints when they are not optional or clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: 该文件的标题、说明和操作步骤均仅以中文呈现，没有提供语言选项、双语支持或说明其必须限定中文的原因。根据语言/locale 政策，若技能内容强制特定语言而无用户选择或合理限定，可构成自然语言政策问题。