Financial Search Engine

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent financial-information search tool, but it uses an Eastmoney API key, sends search queries to Eastmoney, and saves result text locally by default.

Before installing, confirm you trust the Eastmoney service endpoint, use a revocable EM_API_KEY, avoid entering confidential financial details in queries, and use --no-save if you do not want retrieved results stored locally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Your Eastmoney API key may authorize usage or quota on that service.

Why it was flagged

The script reads an API key from the environment and sends it as an authentication header to the financial data provider. This is purpose-aligned, but it is still credential use.

Skill content

EM_API_KEY = os.environ.get("EM_API_KEY", "") ... "em_api_key": api_key

Recommendation

Use a scoped, revocable API key if available, keep it out of shared logs and prompts, and revoke it if you suspect exposure.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any confidential company, portfolio, or strategy details included in a query may be sent to the external provider.

Why it was flagged

The user's natural-language financial query is posted to a remote Eastmoney MCP-like tool endpoint. This is central to the skill, but query text leaves the local environment.

Skill content

MCP_URL = "https://ai-saas.eastmoney.com/proxy/b/mcp/tool/searchNews" ... payload = {"query": query, "toolContext": _load_optional_tool_context()}

Recommendation

Avoid putting non-public or highly sensitive financial information in queries unless you trust the provider and its terms.

Note

ASI02: Tool Misuse and Exploitation

What this means

Retrieved financial content may remain on disk after the search finishes.

Why it was flagged

Search results are written to a local text file by default. The path is scoped and the SKILL.md documents the --no-save option, so this is a notice rather than a concern.

Skill content

DEFAULT_OUTPUT_DIR = Path.cwd() / "miaoxiang" / "mx_finance_search" ... output_path.write_text(content, encoding="utf-8")

Recommendation

Use --no-save when you do not want local files, and clean up the output directory if results should not persist.