ClawHub
Back to skill

Security audit

Stock Unified

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only stock and market data helper that contacts public financial data sources, with some extra market-data features that should be documented more clearly.

Install only if you are comfortable with the skill installing Python packages and making outbound requests to public financial-data services. Treat returned market data as informational, and be aware that the implemented CLI includes additional read-only market-data commands beyond the A-share features emphasized in the main skill description.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises executable commands that install packages and run Python scripts which clearly require network and shell capabilities, yet no permissions are declared. This creates a transparency and governance gap: hosts or reviewers may not realize the skill can reach external financial data sources and execute local commands, increasing the risk of unexpected outbound access or execution in restricted environments.

Tp4

High
Category
MCP Tool Poisoning
Confidence
80% confidence
Finding
A description-behavior mismatch is a real security concern because it undermines informed consent and policy enforcement: a skill presented as A-share stock data may also retrieve broader market, futures, or diagnostic data beyond the declared scope. Even if the extra functionality is not obviously malicious, hidden or under-declared capabilities make it harder to assess data flows, trigger conditions, and whether the skill may be invoked in contexts the user did not intend.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The activation description is broad enough that the skill could trigger on many generic stock-related requests without clear boundaries, which can cause over-invocation and unnecessary external data access. In an agent system, overly broad routing increases the chance of the wrong tool being selected, potentially exposing user prompts or causing actions the user did not explicitly request.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""调用 unified_stock.py CLI 并解析 JSON 输出"""
    try:
        cmd = [sys.executable, SCRIPT] + list(args) + ["--json"]
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        out = r.stdout.strip()
        # 尝试提取首个 { } JSON 块
        m = re.search(r"\{.*\}", out, re.DOTALL)
Confidence
81% confidence
Finding
subprocess.run(cmd, capture_output

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.