Financial Search Engine

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Your Eastmoney API key may authorize usage or quota on that service.

Why it was flagged

The script reads an API key from the environment and sends it as an authentication header to the financial data provider. This is purpose-aligned, but it is still credential use.

Skill content

EM_API_KEY = os.environ.get("EM_API_KEY", "") ... "em_api_key": api_key

Recommendation

Use a scoped, revocable API key if available, keep it out of shared logs and prompts, and revoke it if you suspect exposure.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any confidential company, portfolio, or strategy details included in a query may be sent to the external provider.

Why it was flagged

The user's natural-language financial query is posted to a remote Eastmoney MCP-like tool endpoint. This is central to the skill, but query text leaves the local environment.

Skill content

MCP_URL = "https://ai-saas.eastmoney.com/proxy/b/mcp/tool/searchNews" ... payload = {"query": query, "toolContext": _load_optional_tool_context()}

Recommendation

Avoid putting non-public or highly sensitive financial information in queries unless you trust the provider and its terms.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Retrieved financial content may remain on disk after the search finishes.

Why it was flagged

Search results are written to a local text file by default. The path is scoped and the SKILL.md documents the --no-save option, so this is a notice rather than a concern.

Skill content

DEFAULT_OUTPUT_DIR = Path.cwd() / "miaoxiang" / "mx_finance_search" ... output_path.write_text(content, encoding="utf-8")

Recommendation

Use --no-save when you do not want local files, and clean up the output directory if results should not persist.