ClawHub
Back to skill

Security audit

Finance Data Fetcher

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a straightforward China A-share financial data helper, with some packaging and transparency issues to review before use.

Before installing, verify that the missing skill_main.py is supplied by the publisher or package system, pin reviewed dependency versions, and treat stock-code lookups as external requests that may be logged by market data providers.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.json:7
Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Updates

Content
View full analysis

Vulnerability Details

File Location: skill.json:7 and SKILL.md:59
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

skill.json:7:

json
"dependencies": ["akshare", "pandas", "requests"],

SKILL.md:59:

bash
pip install akshare pandas numpy requests

Technical Analysis

The project declares and recommends installing dependencies without exact version constraints or integrity hashes. Consequently, installation resolves whichever releases are currently selected by the configured package index rather than a set of reviewed and reproducible artifacts.

If a dependency maintainer account, package release, package index, or package-resolution configuration is compromised, a malicious new release could be selected automatically. Installation hooks or imported package code would then execute with the privileges of the user or automation environment running the skill.

The package names themselves do not demonstrate typosquatting or known malicious behavior. The risk arises from unconstrained future package resolution. Additionally, the referenced skill_main.py is absent from the audited artifact, so no implementation-level execution path could be verified beyond the documented installation process.

Attack Path

  1. An attacker compromises an upstream dependency, its publishing account, or a package index used by the installation environment.
  2. The attacker publishes a malicious release under one of the unconstrained dependency names.
  3. A user or CI process executes the documented pip install akshare pandas numpy requests command, or tooling resolves the dependencies listed in skill.json.
  4. The package manager selects the malicious release because no approved version or artifact hash is enforced.
  5. Malicious installation or runtime code executes under the privileges of the installing process.

Impact Assessment

Successful ...[truncated 620 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version, including the documented numpy dependency.
  2. Generate and commit a lock file containing resolved transitive dependencies.
  3. Require cryptographic hashes during installation, such as with a hash-locked requirements file and pip install --require-hashes.
  4. Install packages only from an approved package index or internal artifact mirror.
  5. Add automated dependency vulnerability and provenance scanning to CI.
  6. Review dependency updates before regenerating the lock file rather than automatically accepting newly published releases.
  7. Perform installation and execution in an isolated, least-privileged environment without unnecessary credentials.
  8. Ensure skill.json and SKILL.md declare the same complete dependency set.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is written only in Chinese, which imposes a specific language/locale in the skill's natural-language metadata. The file does not offer any user language choice or explain that the skill is intentionally region-specific, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill description, examples, and function parameter examples are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation names third-party data sources and encourages live data fetching, but it does not clearly warn users that stock codes and related query parameters will be transmitted to external providers. This creates a transparency and privacy-consent gap: users may unknowingly disclose their market interests or research targets to third parties.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.