ClawHub
Back to skill

Security audit

F-AI 资讯搜索

Security checks for vulnerabilities and agentic risk

Overview

This finance-news skill is mostly purpose-aligned, but it sends user queries to external UAT APIs and asks agents to use a session cookie without clear credential-handling safeguards.

Review this skill before installing. Prefer a pinned package version, avoid running npx with elevated privileges, and only use it in an environment where sending finance/news queries and any required sl-session cookie to the documented Finloop UAT domains is acceptable. Do not paste or log session cookies unless you understand who controls the endpoint and how the credential is scoped.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-19; duplicated in .agents/skills/finloop-news-skill/SKILL.md:15-19
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown
### Install through npm/npx (recommended)

```bash
# Install into the local project
npx finloop-news-skills install finloop-news-skill
text

### Technical Analysis

The documented installation command executes the npm package `finloop-news-skills` without specifying an exact version or verifying package integrity. When the package is not already available locally, `npx` can retrieve the package currently published under that name and execute its CLI.

Consequently, the code executed by users is not necessarily the same code reviewed in this audit. A later malicious release, npm account compromise, package-name takeover, or registry compromise could alter the effective installation payload. The empty repository URL in the supplied manifest also prevents users from readily validating package provenance against a canonical source repository.

This is a supply-chain risk rather than evidence that the currently supplied installer is malicious.

### Attack Path

1. An attacker compromises the npm publisher account, takes control of the package, or causes a malicious later version to be published.
2. The attacker publishes modified package contents or malicious npm lifecycle behavior under `finloop-news-skills`.
3. A user follows the documented unpinned command:
   `npx finloop-news-skills install finloop-news-skill`.
4. `npx` resolves and downloads the attacker-controlled current package version.
5. The package CLI or applicable lifecycle scripts execute with the permissions of the user running `npx`.
6. The malicious package can access or modify resources available to that user.

### Impact Assessment

Successful exploitation could result in arbitrary code execution under 
...[truncated 428 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installation command to a reviewed exact version:
    bash
    npx finloop-news-skills@1.1.3 install finloop-news-skill
  2. Publish npm provenance attestations and populate the manifest with the canonical repository URL and release source.
  3. Provide package checksums or integrity metadata through a trusted release channel.
  4. Avoid npm lifecycle scripts unless strictly necessary, and document any scripts that execute during installation.
  5. Recommend testing installation in a restricted environment without unnecessary credentials or elevated privileges.
  6. Keep both copies of the installation documentation synchronized so that neither reintroduces an unpinned command.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

md
- **技能清单**：`SKILL.md` - 包含场景预设和重要规则

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .agents/skills/finloop-news-skill/SKILL.md (reported line 456)May include surrounding context.

md
## 通用注意事项

1. **必须直接使用 HTTP 请求**：
   - ✅ 直接使用 fetch、axios、curl 或其他 HTTP 客户端调用接口
   - ❌ **禁止创建任何封装函数或 JS/TS 文件**
   - ❌ **禁止创建 `api/news.ts`、`utils/api.js` 等封装文件**
   - ❌ **禁止使用 `import` 或 `require` 引入封装函数**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .agents/skills/finloop-news-skill/SKILL.md (reported line 481)May include surrounding context.

md
9. **股票行情查询**：查询股票行情时必须包含所有返回的字段信息，如果用户提到股票名称或指数名称，需要依靠 skill 来主动转换为对应的股票代码（ISIN格式）

10. **调用示例**：
    - ✅ 正确：直接使用 `fetch('https://ai-uat.finloopfintech.com/flp-news-api/v1/news-agent/financeBreakfast', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({}) })`
    - ✅ 正确：直接使用 `curl -X POST --location 'https://ai-uat.finloopfintech.com/flp-news-api/v1/news-agent/financeBreakfast' --header 'Content-Type: application/json' --data '{}'`
    - ❌ 错误：创建 `api/news.ts` 文件并封装函数
    - ❌ 错误：使用 `import { getFinanceBreakfast } from '@/api/news'`

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

All natural-language instructions, triggers, and usage guidance in the skill are presented exclusively in Chinese, effectively forcing a single language/locale for users and integrators. There is no opt-in language choice or explicit justification that this is a region-specific skill limited to Chinese-language use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill recommends installation via npx finloop-news-skills install finloop-news-skill without pinning an exact package version or integrity. That creates a supply-chain risk: a later malicious or compromised package release could be fetched and executed automatically at install time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs use of cookie-based authentication via sl-session but does not warn about secure handling, scope, storage, or user consent for session credentials. This increases the risk of credential leakage, misuse of an interactive user session, or sending sensitive cookies to external UAT systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases for invoking news search are very broad, including common requests like searching for a topic or asking for related news. In an agent setting, this can cause unintended tool/network invocation and accidental transmission of user queries to external services without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

md
## 通用注意事项

1. **必须直接使用 HTTP 请求**：
   - ✅ 直接使用 fetch、axios、curl 或其他 HTTP 客户端调用接口
   - ❌ **禁止创建任何封装函数或 JS/TS 文件**
   - ❌ **禁止创建 `api/news.ts`、`utils/api.js` 等封装文件**
   - ❌ **禁止使用 `import` 或 `require` 引入封装函数**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 481)May include surrounding context.

md
9. **股票行情查询**：查询股票行情时必须包含所有返回的字段信息，如果用户提到股票名称或指数名称，需要依靠 skill 来主动转换为对应的股票代码（ISIN格式）

10. **调用示例**：
    - ✅ 正确：直接使用 `fetch('https://ai-uat.finloopfintech.com/flp-news-api/v1/news-agent/financeBreakfast', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({}) })`
    - ✅ 正确：直接使用 `curl -X POST --location 'https://ai-uat.finloopfintech.com/flp-news-api/v1/news-agent/financeBreakfast' --header 'Content-Type: application/json' --data '{}'`
    - ❌ 错误：创建 `api/news.ts` 文件并封装函数
    - ❌ 错误：使用 `import { getFinanceBreakfast } from '@/api/news'`

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text and command guidance are entirely in Chinese, and the file does not provide any language-selection mechanism or indicate that the tool is intentionally limited to a Chinese-speaking audience. This creates a natural-language policy issue because the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code hardcodes all user-facing messages, prompts, and comments in Chinese, including installation status and overwrite confirmation. That creates a language/locale policy issue because the skill does not offer any user choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The script tells users to run npx finloop-news-skills install finloop-news-skill without pinning a specific package version. Because npx resolves and executes the latest published package by default, a compromised maintainer account, typo-squatted package, or malicious future release could cause arbitrary code execution on user machines. In a publish/install workflow, this is more dangerous because it is presented as the canonical installation command for downstream users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill mandates automatically fetching all AI hot-news details after listing items, which increases network activity beyond the initial user-visible request. While not inherently a direct compromise, it can surprise users, amplify data sharing with the provider, and raise privacy, cost, or rate-limit concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script’s user-facing comments and prompts are written entirely in Chinese, including operational messages and the confirmation prompt. This imposes a specific language on users without opt-in or indication that the skill is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.