T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_summary.py:31- Finding
Unencrypted transport permits manipulation of stock data and trading signals
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Summary
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill is not deceptive, but it should be reviewed because it can produce unreliable trading signals and writes charts to a fixed privileged path.
Install only if you are comfortable treating the output as a rough, non-personalized technical summary. Do not rely on its buy/sell/hold signal for financial decisions, especially for Hong Kong tickers or A-share data, until the routing, quote fields, HTTPS/data validation, and chart output path are fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_summary.py:244- Finding
Predictable chart path enables file clobbering and potential symlink-based writes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior promises accurate stock analysis across CN, HK, and US markets, but the implementation reportedly misclassifies Hong Kong tickers, outputs incorrect OHLC fields, and handles the chart artifact unclearly. In a financial-analysis context, materially incorrect market data and signals can mislead users into harmful financial decisions, making this more dangerous than a normal formatting bug.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs execution of a local Python script that uses both shell and network capabilities, but the manifest does not declare any tool scope or permission boundaries. This creates an authorization gap where the runtime may permit broader behavior than users or reviewers expect, reducing transparency and increasing the risk of misuse or unintended external access.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough that ordinary conversation about stocks may activate the skill without clear user intent, causing unsolicited script execution and network access. Because the skill provides financial analysis, accidental activation can also surface unrequested investment guidance, increasing user-risk and trust issues.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill produces buy/sell/hold recommendations without any disclaimer, suitability warning, or statement that the output is informational rather than personalized financial advice. In this context, users may over-rely on simplistic technical indicators and act on the recommendations, creating meaningful financial harm and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases, examples, and output template are written entirely in Chinese, and the skill does not state that this locale restriction is optional or region-specific. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code performs a file write by saving a generated chart to /root/.openclaw/workspace/stock_chart.png. Although the operation is functional, the script does not warn the user up front that it will create or overwrite a file at a specific path; the only mention appears after the save succeeds.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a stock summary skill that returns real-time quote details, which implies correctly reporting quote components such as open, high, and low. However, these lines print the current price string again instead of the separately fetched open/high/low values, so the actual behavior does not match the claimed quote output.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module description and most user-facing output strings are presented only in Chinese, which effectively forces a specific language for interaction. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.
- Content