Hk Stock Morning Report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.4.11

Overview

The skill is mostly a disclosed HK stock morning-report workflow, but it can forward an internal-labeled report to WeChat and Feishu without clear recipient controls or per-send confirmation.

Review before installing. Use it only in an environment where web searches are allowed, the output path is controlled, and WeChat/Feishu recipients are explicitly configured and confirmed before each send. Do not use it for confidential bank material until forwarding controls and safer file-writing behavior are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:150

Finding

Unsafe privileged report-file overwrite through a fixed output path

Content

View full analysis

None: """Write report to OUTPUT_FILE.""" with open(OUTPUT_FILE, "w", encoding="utf-8") as f: f.write(content) ``` ### Technical Analysis The report destination is hard-coded inside `/root/.openclaw/workspace`, implying that the script may be executed with elevated filesystem privileges. The destination is opened in write mode without first verifying that it is a regular file owned by the expected user. Python's standard `open()` follows symbolic links. It also truncates an existing destination immediately when opened with mode `"w"`. If another user or compromised process can modify the workspace, it can replace `stock_morning_report.md` with a symbolic link to a different file. The script would then follow that link and overwrite the linked target using the permissions of the process running the report generator. There is also a time-of-check/time-of-use risk if validation is added separately without using safe file-descriptor operations. The implementation does not use exclusive creation, `O_NOFOLLOW`, restrictive permissions, or an atomic temporary-file replacement strategy. ### Attack Path 1. The report generator is configured to run with sufficient privileges to write under `/root/.openclaw/workspace`. 2. An attacker obtains write access to that workspace through another user, process, container mount, or compromised component. 3. The attacker removes or renames `stock_morning_report.md`. 4. The attacker creates a symbolic link named `stock_morning_report.md` pointing to a file writable by the report generator. 5. The Skill invokes `save_report()`. 6. `open(... ...[truncated 1037 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a complete morning-report skill with specific data sources and outbound delivery channels. The actual code chunk only handles a narrow subset of that workflow: fetching two HK indices from Tencent Finance, computing labels, composing a markdown template, and saving it to a local file. It explicitly states that web-search-based sections must be completed elsewhere by an AI agent, so the code does not itself fulfill the full declared purpose. The most material mismatches are the absence of WeChat/Feishu push behavior and the absence of the non-Tencent data sources named in the description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The changelog records a mandatory output title format entirely in Chinese, using wording such as '必須為' and '開頭必須包含', which indicates a fixed language/output-locale requirement. Because there is no accompanying note that users may choose another language or locale, this can violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs reading and writing local files and performing live network retrieval, but it declares no explicit tool scope or permission boundaries. In an agent environment, that creates an over-privileged and poorly governed execution path where file and network actions may occur without clear authorization or containment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are short and generic, so the skill may activate during ordinary conversation about the stock market rather than only on deliberate invocation. Because the skill can perform network access, read cached reports, and potentially initiate downstream sending workflows, accidental triggering can cause unintended data processing or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that reports are sent to personal WeChat and Feishu groups, yet it provides no explicit consent, recipient validation, or transmission warning. Given the report is labeled as internal and may contain market-sensitive institutional content, silent or poorly controlled forwarding creates a meaningful risk of confidential data leakage to unintended recipients or external platforms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file is entirely prescriptive about producing a report in Chinese-specific formatting and wording, including exact Chinese labels, punctuation, and output structure, but it does not indicate that the language requirement is optional or user-selected. That can constitute a language/locale policy violation because it imposes a specific locale on the skill behavior without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring states that the script 'Fetches index data from Tencent Finance API and generates the morning report in the standard format.' However, the runtime behavior shown later only retrieves limited index data and explicitly prints that key sections must be completed by an AI agent using the SKILL.md workflow, which contradicts the claim that this script itself generates the report.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/generate_report.py (reported line 34)May include surrounding context.

python

try:
        with urllib.request.urlopen(url, timeout=10) as resp:
            raw = resp.read().decode("gbk")
        # Format: v_r_hkHSI="100,恒生指數,28645.88,28645.88,28555.71,28555.71,28555.71,28555.71,0,0,28645.88,28555.71,0,28645.88,28555.71,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"
        # Field 1=code, 2=name, 3=price, 4=prev_close, 5=open, ...
        parts = raw.split("~")
        if len(parts) < 4:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated report content is entirely fixed in Chinese, including headers and disclosure text, and the file-level description also presents bilingual naming but no user opt-in for language selection. This can violate language/locale policy because the skill forces a specific output language rather than allowing user choice or clearly documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that generates an HK stock morning report using multiple named data sources and supports pushing to WeChat personal and Feishu groups. In this file, the main routine only fetches HSI/HSTECH data from Tencent and then prints instructions saying the web-search sections must be completed by the AI agent via a separate workflow, with no code here implementing the multi-source report generation or any push delivery.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.