ClawHub
Back to skill

Security audit

FinXData Chinese Stock Data

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed FinXData client for scoped financial-data lookups, with no hidden persistence, destructive behavior, or unrelated data access found.

Install this only if you are comfortable using FinXData for financial-data lookups. Prefer the free agent endpoints when they meet your need; only set FINXDATA_API_KEY for account-backed data, and remember that finance queries and credentials for paid/authenticated endpoints go to FinXData's official API.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to use shell commands, environment variables, and outbound network access, but it does not declare any tool scope or permission boundaries in metadata. This creates a real least-privilege gap: an integrator or agent runtime may grant broader capabilities than intended, increasing the risk of command execution, secret exposure, or unreviewed network activity if the skill is invoked in an unsafe context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language content of the skill is consistently Chinese-only, including the description and operating instructions. This can amount to a language-policy violation when users are not given an explicit option to receive instructions in another language or to opt into Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The natural-language description and prompt are written to direct behavior in Chinese and specify using simple language, but they do not offer the user a language choice or explain a justified region-specific requirement. This can violate language/locale policy by imposing a specific language without explicit user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Enabling implicit invocation without documented trigger constraints can cause the skill to activate in broader contexts than intended, including finance-related conversations where the user did not explicitly request this tool. In a financial-data skill, unintended activation can steer responses toward external data retrieval, create confusing tool behavior, and increase the attack surface for prompt-routing abuse or unintended data disclosure through tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The title and all user-facing guidance are written exclusively in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally limited to Chinese-speaking users for a documented regional/compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code returns multiple hard-coded user-facing error messages in Chinese, including authentication, not found, rate limit, and service error responses. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Timeout, TLS, DNS, and connection failure messages are emitted only in Chinese. Because these are user-visible outputs and the file does not provide a locale selection mechanism or documented regional constraint, they violate the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

该文件全文以中文撰写，包含命令说明、使用约束和错误处理，但没有提供多语言选项，也没有说明该技能仅面向中文用户或特定区域用户。按照语言/locale 政策，强制单一语言且未取得用户选择或明确正当化，属于自然语言层面的潜在策略违规。

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/finxdata.py (reported line 721)May include surrounding context.

python
def command_data(args: argparse.Namespace) -> None:
    spec = ENDPOINTS[(args.group, args.action)]
    params = {
        name: getattr(args, name) for name, _required, _default in spec["parameters"]
    }
    is_agent = (args.group, args.action) in AGENT_ENDPOINTS
    agent_type = None

Static analysis

No suspicious patterns detected.