new-stock-analyzer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:51 AM UTC
• Version: 1.0.2

Overview

This stock-analysis skill has a coherent purpose, but it needs review because it adds a persistent daily job, uses insecure financial-data transport, and injects an undisclosed private-network link into generated notices.

Review this before installing. Use it only in an unprivileged account and a dedicated virtual environment, avoid enabling cron until the job has a clear uninstall path, remove the hardcoded private-network URL, pin dependencies, and switch financial data sources to verified HTTPS. Treat its reports as informational only, not investment advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/openclaw_daily.sh:99

Finding

Undisclosed Private-Network URL and Author Branding Injected into Notification Output

Content

View full analysis

"$NOTIFICATION_FILE" 2>&1 # 检查文件大小 FILE_SIZE=$(wc -c < "$NOTIFICATION_FILE") if [ "$FILE_SIZE" -lt 100 ]; then log "⚠️ 通知内容过少，可能无新股数据" echo "📅 今日无新股申购" > "$NOTIFICATION_FILE" fi # 添加时间戳 echo "" >> "$NOTIFICATION_FILE" echo "🕐 时间: $(date '+%Y-%m-%d %H:%M:%S')" >> "$NOTIFICATION_FILE" echo "🌐 服务地址: http://10.3.0.15:25915/jvygnr/" >> "$NOTIFICATION_FILE" echo "🛡️ 你的助理 佑安" >> "$NOTIFICATION_FILE" log "📄 通知文件已生成: $NOTIFICATION_FILE" log "📊 文件大小: ${FILE_SIZE}字节" # 显示通知内容（前10行） log "📋 通知内容预览:" head -20 "$NOTIFICATION_FILE" | while IFS= read -r line; do log " $line" done log "✅ OpenClaw通知准备完成" log "💡 通知将通过OpenClaw会话自动发送" } ``` ### Technical Analysis Every scheduled notification file is unconditionally modified to contain a hardcoded private-network URL and author branding. The URL is unrelated to the stated IPO-analysis function and is not disclosed in the installation or notification documentation. This constitutes stable output manipulation: users requesting stock-analysis results receive additional attacker-selected content. Although the current script does not actually send the notification through an OpenClaw API, the resulting file and its preview are represented as an OpenClaw notification. If another component later forwards that file, the injected URL will be propagated automatically. ### Attack Path 1. A user follows the documented installation process and enables the daily cron task. 2. Cron ...[truncated 829 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: stock_data_enhanced.py:82

Finding

Financial Data Used for Investment Recommendations Is Retrieved over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openclaw_daily.sh:100

Finding

Predictable Shared Temporary Files Allow Symlink-Based File Overwrite

Content

View full analysis

"$NOTIFICATION_FILE" 2>&1 ``` The enhanced script uses the same pattern: ```bash # 输出文件 OUTPUT_FILE="/tmp/new_stock_enhanced_$(date +%Y%m%d_%H%M%S).txt" # 执行增强版分析 python3 main_enhanced.py --daily --output "$OUTPUT_FILE" 2>&1 | tee -a "$LOG_FILE" ``` Cleanup operates on broad patterns in the global temporary directory: ```bash # 清理临时文件（保留最近3天的） find /tmp -name "new_stock_*.txt" -mtime +3 -delete 2>/dev/null || true find /tmp -name "new_stock_enhanced_*.txt" -mtime +3 -delete 2>/dev/null || true find /tmp -name "new_stock_weekly_*.txt" -mtime +3 -delete 2>/dev/null || true ``` ### Technical Analysis The filename is derived from the current timestamp and is therefore predictable. Shell redirection and Python’s ordinary file opening follow symbolic links. On a multi-user system, another local user can pre-create the anticipated pathname as a symbolic link to a file writable by the cron user. When the scheduled task runs, the target can be truncated and replaced. The enhanced script also searches the shared `/tmp` namespace and deletes any matching old files, without proving that the application created them. ### Attack Path 1. A local attacker determines that the task runs daily at 10:00. 2. Immediately before execution, the attacker predicts the timestamp-based filename. 3. The attacker creates that pathname in `/tmp` as a symbolic link to a file writable by the victim user. 4. The scheduled shell redir ...[truncated 635 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/openclaw_daily.sh:38

Finding

Unattended Scheduled Jobs Install Mutable and Unpinned Python Dependencies

Content

View full analysis

/dev/null; then log "警告: 未找到$module模块，尝试安装..." pip3 install $module || log "安装$module失败，但继续执行" fi done ``` The enhanced task can install the complete requirements file: ```bash # 检查Python包 if ! python3 -c "import requests, pandas, statistics" &> /dev/null; then log "📦 缺少Python依赖，尝试安装..." pip3 install -r requirements.txt || error_exit "安装依赖失败" fi ``` The dependency file uses unbounded minimum versions and includes development packages in the runtime set: ```text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 pandas>=1.5.0 pyyaml>=6.0 python-dotenv>=0.21.0 # 开发依赖（可选） pytest>=7.0.0 black>=22.0.0 flake8>=5.0.0 ``` ### Technical Analysis Scheduled operation should execute a previously installed, reviewed environment. Instead, these jobs can contact package indexes and execute package installation logic without an interactive review. Minimum-only constraints permit any future version satisfying the lower bound. There is no lockfile, hash verification, upper bound, or index restriction. Development tools are also included in the requirements installed by setup and the enhanced scheduled job, unnecessarily increasing the dependency and transitive-dependency surface. No malicious dependency was identified in the current list. The vulnerability is exposure to future repository compromise, dependency takeover, or incompatible package updates. ### Attack Path 1. The user enables the scheduled task or runs the setup script ...[truncated 919 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/setup_cron.sh:40

Finding

Setup Script Combines Privileged Package Installation with Persistent Cron Registration

Content

View full analysis

/dev/null; then warn "未找到pip3，尝试安装..." if command -v apt-get &> /dev/null; then sudo apt-get update && sudo apt-get install -y python3-pip elif command -v yum &> /dev/null; then sudo yum install -y python3-pip else error "无法自动安装pip3，请手动安装" exit 1 fi fi ``` It then modifies persistent user state: ```bash # 构建cron命令 CRON_CMD="$CRON_TIME cd '$PROJECT_DIR' && bash scripts/openclaw_daily.sh >> '$PROJECT_DIR/data/logs/cron.log' 2>&1" # 检查是否已存在 if crontab -l 2>/dev/null | grep -q "openclaw_daily.sh"; then warn "检测到已存在的定时任务" echo "当前crontab内容:" crontab -l 2>/dev/null | grep -A2 -B2 "openclaw_daily.sh" read -p "是否替换现有任务？(y/N): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then # 删除现有任务 crontab -l 2>/dev/null | grep -v "openclaw_daily.sh" | crontab - log "已删除现有任务" else log "保留现有任务，跳过设置" return fi fi # 添加新任务 (crontab -l 2>/dev/null; echo "$CRON_CMD") | crontab - if [ $? -eq 0 ]; then log "✅ 定时任务设置成功" log "执行时间: 每天 $CRON_TIME" log "执行命令: $CRON_CMD" else error "定时任务设置失败" exit 1 fi # 显示crontab log "当前crontab内容:" crontab -l 2>/dev/null ``` ### Technical Analysis Cron persistence is disclosed in `README.md` and `SKILL.md`, and the setup script presents an initial confirmation prompt. It is therefore not a concealed backdoor. It is, however, optional rather than necessary for the core stock-analysis function. The script combines several materially different operations under one broad confirmation: system inspection, possible sudo package installation, Python dependency installation, live ...[truncated 1392 chars]

Remediation

View remediation

`. 6. Delete only the exact marked entry installed by this project. 7. Provide and document an uninstall command that removes the cron entry and generated files. 8. Offer manual execution as the default and make scheduling an optional, separately invoked feature. 9. Display the full persisted command and its side effects before installation. ]]>

other

Warning

• Location: main_enhanced.py:265

Finding

Notification Delivery and Data-Validation Claims Do Not Match the Implemented Behavior

Content

View full analysis

str: """ 发送错误通知 Args: error: 错误信息 Returns: 错误通知内容 """ current_time = datetime.now().strftime('%Y-%m-%d %H:%M') message = f"""❌ **新股分析工具错误通知** {current_time} ### 错误详情 {error[:200]} ### 处理建议 1. 检查网络连接 2. 检查数据源可用性 3. 查看详细日志: `data/logs/app.log` """ self._record_notification('error', 0, error=error) return message ``` The manual validator embeds a fixed data snapshot: ```python def __init__(self): # 中财网新股数据（手动提取，2026-03-16） self.cfi_stocks = [ { 'source': 'cfi_manual', 'code': '688813', 'name': '泰金新能(科)', 'apply_date': '2026-03-20', 'issue_price': None, 'market_type': '科创板', 'apply_code': '沪:787813', }, ``` Its report contains unconditional field-level conclusions that are not calculated from the supplied records: ```python lines.append("\n📋 详细对比:") lines.append(" 1. 市场分类: ✅ 完全一致") lines.append(" 2. 申购日期: ✅ 完全一致") lines.append(" 3. 发行价格: ✅ 完全一致") lines.append(" 4. 数据差异: ⚠️ 中财网缺少普昂医疗(920069)") lines.append("\n🎯 结论: 数据高度可靠，可投入使用") ``` ### Technical Analysis The do ...[truncated 1793 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (84)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · main_fixed.py (reported line 299)May include surrounding context.

python

parser.add_argument('--daily', action='store_true', help='执行每日分析')
    parser.add_argument('--recent', type=int, nargs='?', const=7, help='执行近期分析（默认7天）')
    parser.add_argument('--validate', action='store_true', help='执行多数据源验证')
    parser.add_argument('--no-validate', action='store_true', help='禁用多数据源验证')
    parser.add_argument('--no-print', action='store_true', help='不打印结果（用于定时任务）')
    
    args = parser.parse_args()

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 46)May include surrounding context.

sh

if ! command -v pip3 &> /dev/null; then
        warn "未找到pip3，尝试安装..."
        if command -v apt-get &> /dev/null; then
            sudo apt-get update && sudo apt-get install -y python3-pip
        elif command -v yum &> /dev/null; then
            sudo yum install -y python3-pip
        else

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 132)May include surrounding context.

sh

��测试有警告"
    fi
    
    log "✅ 工具功能测试完成"
}

# 设置定时任务
setup_cron() {
    log "设置定时任务..."
    
    # 默认执行时间：每天10:00
    CRON_TIME="0 10 * * *"
    
    # 构建cron命令
    CRON_CMD="$CRON_TIME cd '$PROJECT_DIR' && bash scripts/openclaw_daily.sh >> '$PROJECT_DIR/data/logs/cron.log' 2>&1"
    
    # 检查是否已存在
    if crontab -l 2>/dev/null | grep -q "openclaw_daily.sh"; then
        warn "检测到已存在的定时任务"
        echo "当前crontab内容:"
        crontab -l 2>/dev/null | grep -A2 -B2 "openclaw_daily.sh"
        
        read -p "是否替换现有任务？(y/N): " -n 1 -r
        echo
        if [[ $REPLY =~ ^[Yy]$ ]]; then
            # 删除现有任务
            crontab -l 2>/dev/null | grep -v "openclaw_daily.sh" | crontab -
            log "已删除现有任务"
        else
            log "保留现有任务，跳过设置"
            return
        fi
    fi
    
    # 添�

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The primary user-facing documentation begins in Chinese and presents the skill as a Chinese-language tool, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

bash scripts/setup_cron.sh

或手动设置cron（默认10:00）

crontab -e

添加以下行：

0 10 * * * cd /path/to/new-stock-analyzer && bash scripts/openclaw_daily.sh

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and documents capabilities that imply network access, local file reads/writes, dependency installation, and environment interaction, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, missing scope declarations weaken review and enforcement, making it easier for the skill to overreach or for users to misunderstand what it can access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to set up cron-based automatic notifications without a prominent warning that it will send recurring messages into OpenClaw conversations. In an agent/chat environment, recurring outbound messages can create spam, confusion, or unintended disclosure, especially if enabled by users who thought they were just running a one-time analysis tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The documented use of crontab establishes persistence by configuring recurring execution on the host. Persistence is security-relevant because it survives the initial session, broadens blast radius if misconfigured or abused, and can continue generating network activity or chat messages without ongoing user attention.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

bash scripts/setup_cron.sh

或手动设置cron（默认10:00）

crontab -e

添加以下行：

0 10 * * * cd /path/to/new-stock-analyzer && bash scripts/openclaw_daily.sh

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The privacy/security section says all analysis is completed locally, but earlier sections explicitly describe real-time retrieval from external websites. This inconsistency can mislead users about data flow and exposure, which is a security documentation defect even if the fetched market data itself is public.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report claims market classification, subscription date, and issue price are 'completely consistent', but the implementation only compares stock code set overlap and never validates those fields. In a stock analysis skill, this can mislead users into trusting incorrect or incomplete financial data, causing bad decisions and undermining the integrity of the validation process.

Content

No source excerpt is available for this finding.