clawto-market-intel

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.1.0

Overview

This skill fetches public market information as advertised, with no evidence of credential access, persistence, destructive behavior, or hidden data handling.

Install only if you are comfortable with a Chinese-localized market-data skill that makes outbound requests to public financial data providers. Treat its output as informational, verify trading or calendar-sensitive decisions elsewhere, and be especially cautious with the economic-calendar module because its scheduled events are static and may be outdated.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims broad market-intelligence and technical-analysis functionality that the analyzed file does not substantiate, creating a description-behavior mismatch. In security terms, this is dangerous because users and orchestrators may route sensitive or high-trust financial queries to a skill whose actual implementation and safeguards are unclear, enabling misleading outputs or later hidden capability expansion under an overbroad description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The user-facing description and invocation model are entirely presented in Chinese, including the statement that a WeChat message can be used to obtain the market intel. There is no indication that users may opt into another language or locale, which may violate a language-choice policy if the skill is deployed more broadly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger set is broad and includes generic terms such as '行情', '指数', '走势', and '技术分析', which can easily appear in normal conversation and unrelated financial contexts. In an agent environment, this can cause unintended invocation of the skill, leading to surprise data retrieval, incorrect routing, or prompt/context interference from a skill the user did not mean to activate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The manifest advertises shell and network-backed capabilities via referenced scripts and external data sources, but it does not declare any tool scope or allowed-tools restrictions. This creates an unnecessary trust gap: the runtime may permit broader tool access than users or reviewers expect, increasing the risk of unintended external requests or shell execution if the skill is expanded or invoked automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is extremely broad and overlaps with ordinary financial conversation such as '行情', '指数', 'BTC', 'ETH', and '技术分析'. Overbroad triggers can cause unintended auto-activation, which is especially risky for a networked shell-capable skill because it may run in contexts where the user did not intend to invoke external data collection or specialized processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description is entirely written in Chinese and presents the skill behavior and trigger vocabulary as Chinese-first without any indication that users may choose another language. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy issue unless the regional constraint is clearly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a market-intelligence aggregation skill covering market data, news, calendars, and crypto technical analysis, but this file specifically directs the agent to invoke an okx market CLI and curl an external API. While retrieving market data is aligned with the purpose, prescribing shell/CLI execution and raw HTTP tooling is an implementation capability not justified by the manifest-level functional scope and expands the operational surface beyond simple analysis guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

The document instructs direct HTTP access to an external third-party API via curl, which creates an external transmission path outside any trusted market-data interface. In an agent setting, this can bypass centralized controls, leak request metadata, and introduce supply-chain or data-integrity risk if unvetted outbound network access is permitted.

Content

Scanner excerpt · references/crypto-analysis.md (reported line 72)May include surrounding context.

md

- Funding rate: `okx market funding-rate <INST>-USDT-SWAP`
- OI: `okx market open-interest --instType SWAP --instId <INST>-USDT-SWAP`

Fear & Greed: `curl -s https://api.alternative.me/fng/?limit=1`

## Output Format

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script emits Chinese headings and labels such as '早间简报', '行情速览', and '明日关注' throughout its user-facing output. This forces a specific language/locale without any opt-in, selection mechanism, or documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script presents itself as a current economic calendar ('本周宏观事件' / '财经日历') but relies on a hard-coded list of 2026 events. In a financial market intelligence skill, stale or fabricated scheduling data can mislead trading or risk decisions, especially because the date filtering makes the output appear dynamically current even when the source data is not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script title and output strings are presented in Chinese, and there is no indication that the user can select another language or that the skill is intentionally limited to a Chinese-speaking locale. This creates a natural-language policy issue because it imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto-data.sh (reported line 41)May include surrounding context.

sh

round() { awk "BEGIN {printf \"%.1f\", $1}" 2>/dev/null || echo "$1"; }

# ── Fetch Crypto F&G ──
crypto_json=$(curl -sf --max-time 10 "https://api.alternative.me/fng/?limit=2" 2>/dev/null || echo '{}')
crypto_now=$(echo "$crypto_json" | jq -r '.data[0].value // "N/A"')
crypto_prev=$(echo "$crypto_json" | jq -r '.data[1].value // "N/A"')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fear-greed.sh (reported line 8)May include surrounding context.

sh

round() { awk "BEGIN {printf \"%.1f\", $1}" 2>/dev/null || echo "$1"; }

# ── Fetch Crypto F&G ──
crypto_json=$(curl -sf --max-time 10 "https://api.alternative.me/fng/?limit=2" 2>/dev/null || echo '{}')
crypto_now=$(echo "$crypto_json" | jq -r '.data[0].value // "N/A"')
crypto_prev=$(echo "$crypto_json" | jq -r '.data[1].value // "N/A"')

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing output strings are predominantly Chinese, including headings, labels, alerts, and strategy text. This forces a specific language/locale on all users with no opt-in or alternative, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L76 requires ASCII-only output for WeChat compatibility, but the mandated output template in L78-L85 uses Chinese text and emoji. This imposes a specific language/locale presentation rather than offering a user choice, which fits the policy category for language/locale constraints in natural-language instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell skill makes an outbound HTTP request to a CNBC RSS endpoint to fetch live hints, but there is no confirmation prompt, user-facing warning, or explanatory comment in the shell file indicating that external network access will occur. For a code file, external transmission of system/user request context should be disclosed unless clearly signposted as part of the skill's operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits user-facing text in Chinese, such as the failure message on this line, without any indication that the user can select a preferred language or locale. This can violate a language/locale policy when a skill forces a specific language by default rather than making it configurable or documenting the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This line prints a Chinese-only heading to the user, which indicates the skill enforces a specific language in its interface. Under the policy, language constraints should be optional, user-selectable, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code emits user-facing messages in Chinese, including the error message and output labels, with no option to select another language or indication that the skill is intentionally region-specific. That can violate language/locale policy requirements when skills must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.