ClawHub
Back to skill

Security audit

FW-trading

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate Fosun Wealth trading helper, but its installer and credential handling create review-worthy risks for API keys and real trading authority.

Install only if you trust the publisher and are comfortable auditing or hardening the installer first. Prefer preinstalling uv yourself, verify the Fosun SDK source before installation, avoid custom SDK/base URLs unless you control them, and treat fosun.env plus its backups as sensitive trading credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:53
Finding

Mutable remote installer scripts are executed without integrity verification

Content
View full analysis
/dev/null 2>&1; then curl -LsSf https://astral.sh/uv/install.sh | sh elif command -v wget >/dev/null 2>&1; then wget -qO- https://astral.sh/uv/install.sh | sh ``` `real-trade-skill/install.ps1:24-30`: ```powershell Log "未检测到 uv，自动安装..." try { Invoke-RestMethod https://astral.sh/uv/install.ps1 | Invoke-Expression } catch { Fail "uv 自动安装失败，请手动安装后重试。文档：https://docs.astral.sh/uv/getting-started/installation/" } ``` ### Technical Analysis The installation process retrieves a mutable script from an external URL and sends its contents directly to a command interpreter. The downloaded response is not pinned to a specific release, inspected, or verified against a cryptographic checksum or digital signature. HTTPS authenticates the server according to the local trust store, but it does not ensure that the content currently served is identical to the content reviewed during this audit. A compromise of the upstream server, hosting account, DNS or certificate trust chain, content-delivery infrastructure, or build pipeline could therefore change the effective installer payload after publication. This behavior exceeds the minimum privilege necessary to install the Skill. The installer could instead require a separately installed package manager or verify a versioned artifact before executing it. ### Attack Path 1. The user invokes the root shell installer or a PowerShell installer. 2. The installer determines that `uv` is unavailable. 3. It retrieves the current response from `astral.sh`. 4. The response is passed directly to `sh` or `Invoke-Expression`. 5. If the remote source or delivery path has been compromised, a ...[truncated 935 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:23
Finding

Unverified SDK archive from a third-party proxy is installed as executable Python code

Content
View full analysis
/dev/null 2>&1; then curl -fL --connect-timeout 30 --max-time 600 "${url}" -o "${SDK_ZIP_PATH}" return 0 fi if command -v wget >/dev/null 2>&1; then wget -O "${SDK_ZIP_PATH}" "${url}" return 0 fi ``` `install.sh:127-136`: ```bash SDK_EXTRACTED_DIR="$("${VENV_PY}" - "${SDK_ZIP_PATH}" "${SDK_EXTRACT_DIR}" <<'PY' import sys import zipfile from pathlib import Path zip_path = Path(sys.argv[1]) extract_root = Path(sys.argv[2]) extract_root.mkdir(parents=True, exist_ok=True) with zipfile.ZipFile(zip_path, "r") as zf: zf.extractall(extract_root) ``` `install.sh:162-169`: ```bash log "安装 fsopenapi SDK（editable 模式，默认 PyPI 官方源）" if ! uv pip install --python "${VENV_PY}" --reinstall --editable "${SDK_SRC_DIR}"; then log "默认 PyPI 源不可用，改用清华大学 PyPI 镜像重试：${PYPI_MIRROR}" uv pip install --python "${VENV_PY}" --reinstall --editable \ --default-index "${PYPI_MIRROR}" \ "${SDK_SRC_DIR}" fi ``` `real-trade-skill/install.ps1:88-103`: ```powershell Log "下载官方 SDK 源码（主源）：$SdkZipUrlPrimary" try { Invoke-WebRequest -Uri $SdkZipUrlPrimary -OutFile $SdkZipPath $SdkZipUrl = $SdkZipUrlPrimary } catch { if ($SdkZipUrlFallback -and ($SdkZipUrlFallback -ne $SdkZipUrlPrimary)) { Log "主源下载失败，尝试备用源：$SdkZipUrlFallback" Invoke-WebRequest -Uri $SdkZipUrlFallback -OutFile $SdkZipPath $SdkZipUrl = $SdkZipUrlFallback } else { throw } } Log "解压 SDK 源码包" Expand-Archive -Path $SdkZipPath -DestinationPath $Sdk ...[truncated 2447 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
fosun-env-setup/code/ensure_fosun_env.py:697
Finding

TLS certificate verification is disabled while transmitting an API key

Content
View full analysis
dict[str, Any]: url = f"{base_url.rstrip('/')}{path}" response = requests.post( url, json=payload, headers=_auth_headers(), timeout=15, verify=False, ) response.raise_for_status() return _extract_response_data(response.json()) ``` `fosun-env-setup/code/ensure_fosun_env.py:712-717`: ```python def _validate_api_key(base_url: str, api_key: str) -> tuple[str, dict[str, Any]]: try: data = _post_auth_json( base_url, "/api/v1/auth/APIKeyCheck", {"apiKey": api_key}, ) ``` The module also suppresses `InsecureRequestWarning` at line 46: ```python urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) ``` ### Technical Analysis Passing `verify=False` disables server certificate validation for authentication requests. Encryption may still occur, but the client no longer establishes that it is communicating with the legitimate Fosun server. The request body explicitly contains the user's API key. The same helper is also used for authentication operations such as ticket creation, so a man-in-the-middle may be able to observe sensitive values and modify authentication responses or authorization URLs. Suppressing `InsecureRequestWarning` removes the normal runtime indication that transport authentication has been disabled. Because `FSOPENAPI_BASE_URL` is configurable, an attacker who can influence configuration can also direct these sensitive requests to another endpoint. The Base64 operations elsewhere in the file are PEM serialization and are not evidence of covert exfiltration. ...[truncated 1279 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
fosun-env-setup/code/ensure_fosun_env.py:375
Finding

Canonical credential files are written without enforcing restrictive permissions

Content
View full analysis
None: target = env_path or shared_env_path() target.parent.mkdir(parents=True, exist_ok=True) entries = _canonicalize_env_entries(entries) serialized = { key: _encode_env_value(key, value) for key, value in entries.items() if value is not None } # 临时文件 + os.replace 原子落盘，避免写入中断把 fosun.env 截断成半成品。 tmp_path = target.with_name(f".{target.name}.tmp.{os.getpid()}") try: with tmp_path.open("w", encoding="utf-8") as f: for key in sorted(serialized.keys()): f.write(f"{key}={serialized[key]}\n") os.replace(tmp_path, target) ``` `real-trade-skill/code/_client.py:185-195`: ```python def upsert_shared_env(updates: dict[str, Any]) -> None: """安全 upsert 共享 fosun.env：read-modify-write，不丢失实盘已有字段。""" env_path = shared_env_path() env_path.parent.mkdir(parents=True, exist_ok=True) entries = _read_shared_entries() for key, value in updates.items(): entries[key] = "" if value is None else str(value) serialized = {k: _encode_env_value(k, v) for k, v in entries.items() if v is not None} with env_path.open("w", encoding="utf-8") as f: for key in sorted(serialized.keys()): f.write(f"{key}={serialized[key]}\n") ``` ### Technical Analysis The canonical `fosun.env` contains an API key and an unencrypted client private key. PEM values are converted to Base64 for single-line storage, but Base64 is reversible e ...[truncated 2283 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (131)

Tainted flow: 'url' from os.environ.get (line 700, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request target is ultimately influenced by configuration that can come from the FOSUN_ENV_PATH-managed env content or the --base-url argument, and the code sends authentication material to that URL with requests.post. In a credential-management skill, this is dangerous because an attacker who can influence base_url can redirect API keys, public keys, device identifiers, and ticket flows to an attacker-controlled endpoint, effectively turning setup/repair into credential exfiltration.

Content

Scanner excerpt · fosun-env-setup/code/ensure_fosun_env.py (reported line 701)May include surrounding context.

python
def _post_auth_json(base_url: str, path: str, payload: dict[str, Any]) -> dict[str, Any]:
    url = f"{base_url.rstrip('/')}{path}"
    response = requests.post(
        url,
        json=payload,
        headers=_auth_headers(),

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill presents itself as a unified trading gateway with credential lifecycle management, routing, and mutation safeguards, but the analyzed content does not evidence those controls or capabilities. In a financial-trading context, this mismatch is dangerous because users or upstream agents may assume safety properties like routing correctness, single-credential handling, and secondary confirmation exist when they may not, leading to misuse, unsafe trading actions, or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
fosun-env-setup/code/qr_artifact.py:34

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
fosun-env-setup/code/ensure_fosun_env.py:534

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
fosun-env-setup/code/ensure_fosun_env.py:706