ClawHub
Back to skill

Security audit

new-stock-analyzer

Security checks for vulnerabilities and agentic risk

Overview

This stock-analysis skill has a coherent purpose, but it needs review because it adds a persistent daily job, uses insecure financial-data transport, and injects an undisclosed private-network link into generated notices.

Review this before installing. Use it only in an unprivileged account and a dedicated virtual environment, avoid enabling cron until the job has a clear uninstall path, remove the hardcoded private-network URL, pin dependencies, and switch financial data sources to verified HTTPS. Treat its reports as informational only, not investment advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
scripts/openclaw_daily.sh:99
Finding
Undisclosed Private-Network URL and Author Branding Injected into Notification Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw_daily.sh`, lines 99-132 **Vulnerability Type**: Output manipulation and undisclosed redirection **Risk Level**: High ### Vulnerable Code ```bash # 发送OpenClaw通知 send_openclaw_notification() { log "📤 准备发送OpenClaw通知..." # 生成通知文件 NOTIFICATION_FILE="/tmp/new_stock_analysis_$(date +%Y%m%d_%H%M%S).txt" # 运行分析并保存结果 python3 main_fixed.py --daily > "$NOTIFICATION_FILE" 2>&1 # 检查文件大小 FILE_SIZE=$(wc -c < "$NOTIFICATION_FILE") if [ "$FILE_SIZE" -lt 100 ]; then log "⚠️ 通知内容过少，可能无新股数据" echo "📅 今日无新股申购" > "$NOTIFICATION_FILE" fi # 添加时间戳 echo "" >> "$NOTIFICATION_FILE" echo "🕐 时间: $(date '+%Y-%m-%d %H:%M:%S')" >> "$NOTIFICATION_FILE" echo "🌐 服务地址: http://10.3.0.15:25915/jvygnr/" >> "$NOTIFICATION_FILE" echo "🛡️ 你的助理 佑安" >> "$NOTIFICATION_FILE" log "📄 通知文件已生成: $NOTIFICATION_FILE" log "📊 文件大小: ${FILE_SIZE}字节" # 显示通知内容（前10行） log "📋 通知内容预览:" head -20 "$NOTIFICATION_FILE" | while IFS= read -r line; do log " $line" done log "✅ OpenClaw通知准备完成" log "💡 通知将通过OpenClaw会话自动发送" } ``` ### Technical Analysis Every scheduled notification file is unconditionally modified to contain a hardcoded private-network URL and author branding. The URL is unrelated to the stated IPO-analysis function and is not disclosed in the installation or notification documentation. This constitutes stable output manipulation: users requesting stock-analysis results receive additional attacker-selected content. Although the current script does not actually send the notification through an OpenClaw API, the resulting file and its preview are represented as an OpenClaw notification. If another component later forwards that file, the injected URL will be propagated automatically. ### Attack Path 1. A user follows the documented installation process and enables the daily cron task. 2. Cron ...[truncated 829 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded service URL and author branding from generated reports. 2. If a service link is required, make it an explicit configuration value that is disabled by default. 3. Display the configured destination during setup and require affirmative user consent before including it. 4. Permit only approved HTTPS URLs and reject loopback, link-local, and private-network destinations unless the user explicitly enables them. 5. Keep stock-analysis content separate from transport metadata and promotional text. 6. Add tests asserting that generated reports contain only requested analysis data and user-configured fields. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
stock_data_enhanced.py:82
Finding
Financial Data Used for Investment Recommendations Is Retrieved over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Locations**: - `stock_data_enhanced.py`, lines 82-98 - `stock_data.py`, lines 61-81 and 137-141 - `multi_source_validator.py`, lines 52-68 - `ipo_data_validator.py`, lines 38-53 - `config/config.example.yaml`, line 9 **Vulnerability Type**: Unauthenticated network transport for integrity-sensitive financial data **Risk Level**: High ### Vulnerable Code Primary data-fetching path: ```python # 东方财富新股申购API url = "http://datacenter-web.eastmoney.com/api/data/v1/get" params = { 'reportName': 'RPTA_APP_IPOAPPLY', 'columns': 'ALL', 'pageNumber': '1', 'pageSize': '100', 'sortColumns': 'APPLY_DATE', 'sortTypes': '-1', 'source': 'WEB', 'client': 'WEB', } try: logger.info(f"请求东方财富详细API: {url}") response = self.session.get(url, params=params, timeout=15) response.raise_for_status() data = response.json() ``` The same insecure endpoint is used by the cross-source validator: ```python # 东方财富新股申购API url = "http://datacenter-web.eastmoney.com/api/data/v1/get" params = { 'reportName': 'RPTA_APP_IPOAPPLY', 'columns': 'ALL', 'pageNumber': '1', 'pageSize': '100', 'sortColumns': 'APPLY_DATE', 'sortTypes': '-1', 'source': 'WEB', 'client': 'WEB', } logger.info("请求东方财富API...") response = self.session.get(url, params=params, timeout=15) response.raise_for_status() ``` Another plaintext source appears in `stock_data.py`: ```python url = "http://data.10jqka.com.cn/ipo/xgsgyzq/" try: response = self.session.get(url, timeout=10) ``` ### Technical Analysis HTTP provides neither server authentication nor transport integrity. A network-positioned attacker can read or alter the API response without triggering certificate validation. The affected fields include stock identifiers, offering prices, dates, price-to-earnings ratios, issue size, and other inputs consumed by the analysis engines. The modified response can also be cached locally, extending the effec ...[truncated 1280 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace every plaintext endpoint with its verified HTTPS equivalent. 2. Reject redirects from HTTPS to HTTP. 3. Keep TLS certificate verification enabled and fail closed on certificate errors. 4. Apply strict response-schema validation, including expected field types and reasonable numeric ranges. 5. Record the source URL, retrieval time, and validation status with cached records. 6. Do not use or cache a response when transport or schema validation fails. 7. Add automated tests that fail if any production endpoint begins with `http://`. 8. Correct the documentation only after all production transport is demonstrably HTTPS. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/openclaw_daily.sh:100
Finding
Predictable Shared Temporary Files Allow Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/openclaw_daily.sh`, lines 100-107 - `scripts/openclaw_daily_enhanced.sh`, lines 47-53 and 82-87 - `scripts/openclaw_daily_enhanced.sh`, lines 138-152 **Vulnerability Type**: Insecure temporary-file creation and overly broad cleanup **Risk Level**: Medium ### Vulnerable Code ```bash send_openclaw_notification() { log "📤 准备发送OpenClaw通知..." # 生成通知文件 NOTIFICATION_FILE="/tmp/new_stock_analysis_$(date +%Y%m%d_%H%M%S).txt" # 运行分析并保存结果 python3 main_fixed.py --daily > "$NOTIFICATION_FILE" 2>&1 ``` The enhanced script uses the same pattern: ```bash # 输出文件 OUTPUT_FILE="/tmp/new_stock_enhanced_$(date +%Y%m%d_%H%M%S).txt" # 执行增强版分析 python3 main_enhanced.py --daily --output "$OUTPUT_FILE" 2>&1 | tee -a "$LOG_FILE" ``` Cleanup operates on broad patterns in the global temporary directory: ```bash # 清理临时文件（保留最近3天的） find /tmp -name "new_stock_*.txt" -mtime +3 -delete 2>/dev/null || true find /tmp -name "new_stock_enhanced_*.txt" -mtime +3 -delete 2>/dev/null || true find /tmp -name "new_stock_weekly_*.txt" -mtime +3 -delete 2>/dev/null || true ``` ### Technical Analysis The filename is derived from the current timestamp and is therefore predictable. Shell redirection and Python’s ordinary file opening follow symbolic links. On a multi-user system, another local user can pre-create the anticipated pathname as a symbolic link to a file writable by the cron user. When the scheduled task runs, the target can be truncated and replaced. The enhanced script also searches the shared `/tmp` namespace and deletes any matching old files, without proving that the application created them. ### Attack Path 1. A local attacker determines that the task runs daily at 10:00. 2. Immediately before execution, the attacker predicts the timestamp-based filename. 3. The attacker creates that pathname in `/tmp` as a symbolic link to a file writable by the victim user. 4. The scheduled shell redir ...[truncated 635 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Set `umask 077` at the beginning of each script. 2. Create a private runtime directory owned by the current user with mode `0700`. 3. Use `mktemp` rather than timestamp-derived filenames, for example: ```bash RUNTIME_DIR="${XDG_RUNTIME_DIR:-$HOME/.cache/new-stock-analyzer/run}" install -d -m 700 "$RUNTIME_DIR" OUTPUT_FILE="$(mktemp "$RUNTIME_DIR/report.XXXXXX")" ``` 4. Do not follow existing symbolic links; use exclusive file creation where possible. 5. Track files created by the application and delete only those exact files. 6. Avoid broad `find /tmp ... -delete` operations. 7. Ensure the cron task is never installed for or executed as root. ]]>

T08 · Insecure Dependencies

Warning
Location
scripts/openclaw_daily.sh:38
Finding
Unattended Scheduled Jobs Install Mutable and Unpinned Python Dependencies<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/openclaw_daily.sh`, lines 38-45 - `scripts/openclaw_daily_enhanced.sh`, lines 34-40 - `scripts/setup_cron.sh`, lines 58-74 - `requirements.txt`, lines 4-14 **Vulnerability Type**: Unattended dependency installation and insufficient supply-chain controls **Risk Level**: Medium ### Vulnerable Code The persisted daily task installs packages when imports fail: ```bash # 检查必要模块 for module in requests pandas; do if ! python3 -c "import $module" 2>/dev/null; then log "警告: 未找到$module模块，尝试安装..." pip3 install $module || log "安装$module失败，但继续执行" fi done ``` The enhanced task can install the complete requirements file: ```bash # 检查Python包 if ! python3 -c "import requests, pandas, statistics" &> /dev/null; then log "📦 缺少Python依赖，尝试安装..." pip3 install -r requirements.txt || error_exit "安装依赖失败" fi ``` The dependency file uses unbounded minimum versions and includes development packages in the runtime set: ```text requests>=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 pandas>=1.5.0 pyyaml>=6.0 python-dotenv>=0.21.0 # 开发依赖（可选） pytest>=7.0.0 black>=22.0.0 flake8>=5.0.0 ``` ### Technical Analysis Scheduled operation should execute a previously installed, reviewed environment. Instead, these jobs can contact package indexes and execute package installation logic without an interactive review. Minimum-only constraints permit any future version satisfying the lower bound. There is no lockfile, hash verification, upper bound, or index restriction. Development tools are also included in the requirements installed by setup and the enhanced scheduled job, unnecessarily increasing the dependency and transitive-dependency surface. No malicious dependency was identified in the current list. The vulnerability is exposure to future repository compromise, dependency takeover, or incompatible package updates. ### Attack Path 1. The user enables the scheduled task or runs the setup script ...[truncated 919 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove all `pip install` operations from scheduled scripts. 2. Install dependencies once into a dedicated virtual environment during an explicit setup phase. 3. Pin exact reviewed versions in a lockfile. 4. Require hashes with `pip install --require-hashes`. 5. Use a trusted, explicitly configured package index. 6. Separate runtime requirements from development requirements. 7. Run cron with the virtual environment’s absolute Python path. 8. Abort with a clear error if dependencies are missing instead of mutating the environment. 9. Add dependency-scanning and controlled update review to the release process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/setup_cron.sh:40
Finding
Setup Script Combines Privileged Package Installation with Persistent Cron Registration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup_cron.sh`, lines 40-49 and 122-163 **Vulnerability Type**: Persistent scheduled execution and excessive setup privileges **Risk Level**: Medium ### Vulnerable Code The setup process may invoke the system package manager through `sudo`: ```bash # 检查pip if ! command -v pip3 &> /dev/null; then warn "未找到pip3，尝试安装..." if command -v apt-get &> /dev/null; then sudo apt-get update && sudo apt-get install -y python3-pip elif command -v yum &> /dev/null; then sudo yum install -y python3-pip else error "无法自动安装pip3，请手动安装" exit 1 fi fi ``` It then modifies persistent user state: ```bash # 构建cron命令 CRON_CMD="$CRON_TIME cd '$PROJECT_DIR' && bash scripts/openclaw_daily.sh >> '$PROJECT_DIR/data/logs/cron.log' 2>&1" # 检查是否已存在 if crontab -l 2>/dev/null | grep -q "openclaw_daily.sh"; then warn "检测到已存在的定时任务" echo "当前crontab内容:" crontab -l 2>/dev/null | grep -A2 -B2 "openclaw_daily.sh" read -p "是否替换现有任务？(y/N): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then # 删除现有任务 crontab -l 2>/dev/null | grep -v "openclaw_daily.sh" | crontab - log "已删除现有任务" else log "保留现有任务，跳过设置" return fi fi # 添加新任务 (crontab -l 2>/dev/null; echo "$CRON_CMD") | crontab - if [ $? -eq 0 ]; then log "✅ 定时任务设置成功" log "执行时间: 每天 $CRON_TIME" log "执行命令: $CRON_CMD" else error "定时任务设置失败" exit 1 fi # 显示crontab log "当前crontab内容:" crontab -l 2>/dev/null ``` ### Technical Analysis Cron persistence is disclosed in `README.md` and `SKILL.md`, and the setup script presents an initial confirmation prompt. It is therefore not a concealed backdoor. It is, however, optional rather than necessary for the core stock-analysis function. The script combines several materially different operations under one broad confirmation: system inspection, possible sudo package installation, Python dependency installation, live ...[truncated 1392 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Separate dependency setup, functional testing, and cron registration into distinct commands. 2. Require explicit confirmation immediately before each privileged or persistent action. 3. Default every confirmation to refusal, especially for sudo and cron modification. 4. Do not automatically invoke `sudo`; instead, report the missing prerequisite and provide manual instructions. 5. Add a unique marker to the managed cron entry, such as `# new-stock-analyzer:<installation-id>`. 6. Delete only the exact marked entry installed by this project. 7. Provide and document an uninstall command that removes the cron entry and generated files. 8. Offer manual execution as the default and make scheduling an optional, separately invoked feature. 9. Display the full persisted command and its side effects before installation. ]]>

other

Warning
Location
main_enhanced.py:265
Finding
Notification Delivery and Data-Validation Claims Do Not Match the Implemented Behavior<![CDATA[ ## Vulnerability Details **File Locations**: - `main_enhanced.py`, lines 265-271 - `openclaw_notifier.py`, lines 17-333 - `cfi_manual_validator.py`, lines 20-77 and 119-163 - `README.md`, lines 14-16 and 115-125 - `SKILL.md`, lines 40-43 and 169-177 **Vulnerability Type**: Misleading security and functional assurance **Risk Level**: Medium ### Vulnerable Code The enhanced entry point calls a method that does not exist on `OpenClawNotifier`: ```python def send_to_openclaw(self, content: str): """发送到OpenClaw""" try: self.notifier.send_notification(content) logger.info("已发送通知到OpenClaw") except Exception as e: logger.error(f"发送到OpenClaw失败: {e}") ``` `OpenClawNotifier` only formats and returns strings. For example: ```python def send_error_notification(self, error: str) -> str: """ 发送错误通知 Args: error: 错误信息 Returns: 错误通知内容 """ current_time = datetime.now().strftime('%Y-%m-%d %H:%M') message = f"""❌ **新股分析工具错误通知** {current_time} ### 错误详情 {error[:200]} ### 处理建议 1. 检查网络连接 2. 检查数据源可用性 3. 查看详细日志: `data/logs/app.log` """ self._record_notification('error', 0, error=error) return message ``` The manual validator embeds a fixed data snapshot: ```python def __init__(self): # 中财网新股数据（手动提取，2026-03-16） self.cfi_stocks = [ { 'source': 'cfi_manual', 'code': '688813', 'name': '泰金新能(科)', 'apply_date': '2026-03-20', 'issue_price': None, 'market_type': '科创板', 'apply_code': '沪:787813', }, ``` Its report contains unconditional field-level conclusions that are not calculated from the supplied records: ```python lines.append("\n📋 详细对比:") lines.append(" 1. 市场分类: ✅ 完全一致") lines.append(" 2. 申购日期: ✅ 完全一致") lines.append(" 3. 发行价格: ✅ 完全一致") lines.append(" 4. 数据差异: ⚠️ 中财网缺少普昂医疗(920069)") lines.append("\n🎯 结论: 数据高度可靠，可投入使用") ``` ### Technical Analysis The do ...[truncated 1793 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Implement an explicit, authenticated OpenClaw notification transport or remove all direct-delivery claims. 2. Make the notification method return a verifiable delivery result and message identifier. 3. Propagate delivery failure to the command’s exit status rather than only logging it. 4. Replace static CFI data with live retrieval or clearly label it as a historical fixture. 5. Compare stock code, name, date, price, market, and other claimed fields programmatically. 6. Never print “complete agreement” unless every stated comparison was actually performed and passed. 7. Mark missing, stale, or unavailable secondary sources as validation failures. 8. Include source timestamps and freshness thresholds in every validation report. 9. Add tests covering nonexistent notification methods, stale validation records, conflicting prices, and unavailable sources. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (84)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The finding suggests the code mainly fetches and formats metadata with light heuristics while claiming broader dual-source analysis and notifications. In context, this is more dangerous because the skill concerns investment analysis, where overstated rigor can materially affect user decisions and deployment trust.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
parser.add_argument('--daily', action='store_true', help='执行每日分析')
    parser.add_argument('--recent', type=int, nargs='?', const=7, help='执行近期分析（默认7天）')
    parser.add_argument('--validate', action='store_true', help='执行多数据源验证')
    parser.add_argument('--no-validate', action='store_true', help='禁用多数据源验证')
    parser.add_argument('--no-print', action='store_true', help='不打印结果（用于定时任务）')
    
    args = parser.parse_args()
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
if ! command -v pip3 &> /dev/null; then
        warn "未找到pip3，尝试安装..."
        if command -v apt-get &> /dev/null; then
            sudo apt-get update && sudo apt-get install -y python3-pip
        elif command -v yum &> /dev/null; then
            sudo yum install -y python3-pip
        else
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
��测试有警告"
    fi
    
    log "✅ 工具功能测试完成"
}

# 设置定时任务
setup_cron() {
    log "设置定时任务..."
    
    # 默认执行时间：每天10:00
    CRON_TIME="0 10 * * *"
    
    # 构建cron命令
    CRON_CMD="$CRON_TIME cd '$PROJECT_DIR' && bash scripts/openclaw_daily.sh >> '$PROJECT_DIR/data/logs/cron.log' 2>&1"
    
    # 检查是否已存在
    if crontab -l 2>/dev/null | grep -q "openclaw_daily.sh"; then
        warn "检测到已存在的定时任务"
        echo "当前crontab内容:"
        crontab -l 2>/dev/null | grep -A2 -B2 "openclaw_daily.sh"
        
        read -p "是否替换现有任务？(y/N): " -n 1 -r
        echo
        if [[ $REPLY =~ ^[Yy]$ ]]; then
            # 删除现有任务
            crontab -l 2>/dev/null | grep -v "openclaw_daily.sh" | crontab -
            log "已删除现有任务"
        else
            log "保留现有任务，跳过设置"
            return
        fi
    fi
    
    # 添�
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
The primary user-facing documentation begins in Chinese and presents the skill as a Chinese-language tool, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Session Persistence

Medium
Category
Rogue Agent
Content
bash scripts/setup_cron.sh

# 或手动设置cron（默认10:00）
crontab -e
# 添加以下行：
0 10 * * * cd /path/to/new-stock-analyzer && bash scripts/openclaw_daily.sh
```
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and documents capabilities that imply network access, local file reads/writes, dependency installation, and environment interaction, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, missing scope declarations weaken review and enforcement, making it easier for the skill to overreach or for users to misunderstand what it can access.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to set up cron-based automatic notifications without a prominent warning that it will send recurring messages into OpenClaw conversations. In an agent/chat environment, recurring outbound messages can create spam, confusion, or unintended disclosure, especially if enabled by users who thought they were just running a one-time analysis tool.

Session Persistence

Medium
Category
Rogue Agent
Content
bash scripts/setup_cron.sh

# 或手动设置cron（默认10:00）
crontab -e
# 添加以下行：
0 10 * * * cd /path/to/new-stock-analyzer && bash scripts/openclaw_daily.sh
```
Confidence
95% confidence
Finding
The documented use of crontab establishes persistence by configuring recurring execution on the host. Persistence is security-relevant because it survives the initial session, broadens blast radius if misconfigured or abused, and can continue generating network activity or chat messages without ongoing user attention.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The privacy/security section says all analysis is completed locally, but earlier sections explicitly describe real-time retrieval from external websites. This inconsistency can mislead users about data flow and exposure, which is a security documentation defect even if the fetched market data itself is public.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The report claims market classification, subscription date, and issue price are 'completely consistent', but the implementation only compares stock code set overlap and never validates those fields. In a stock analysis skill, this can mislead users into trusting incorrect or incomplete financial data, causing bad decisions and undermining the integrity of the validation process.

Static analysis

No suspicious patterns detected.