ClawHub
Back to skill

Security audit

云梦A股数据获取Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward A-share market data fetcher, with some dependency and documentation quality issues but no evidence of hidden, destructive, or credential-seeking behavior.

Install it only in an isolated environment and pin or lock the Python dependencies first. Expect it to contact Eastmoney and Sina Finance with requested stock symbols, and treat the yesterday limit-up and market-anomaly outputs cautiously until those endpoints are corrected.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Cross-Ecosystem Dependencies Create Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill description and usage guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking users. The policy calls for flagging language or locale constraints when they are imposed without opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language description and user-facing strings in this file are exclusively Chinese, which can amount to forcing a specific language without user opt-in. There is no indication that the skill is intentionally limited to a Chinese-speaking or region-specific audience, nor any alternative language option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation at L249-L254 says this function retrieves yesterday's limit-up stocks, and the code even computes a yesterday value at L260. However, the request at L262 is the same generic current list endpoint used by get_limit_up_stocks and does not incorporate the yesterday date at all, so the implementation does not match the stated intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comment and docstring at L288-L293 describe abnormal market movement data, which implies a distinct dataset. Instead, the code at L299 calls the same Eastmoney clist/get endpoint with the same stock-selection filter as get_limit_up_stocks, indicating it is not actually fetching anomaly-specific data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The user-facing natural-language fields in this manifest are entirely in Chinese, including the top-level description and command descriptions, with no indication that the skill supports other languages or that the Chinese-only scope is an intentional, documented regional constraint. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This Python skill makes network requests to third-party finance services via requests.get, but the code provides no clear user-facing warning that invoking the skill will contact external sites. Although some functions have internal comments and retry logs, those do not explicitly disclose outbound data transmission to the user at the point of use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The package description is written only in Chinese ("云梦A股数据获取Skill"), which indicates a language-specific presentation without any visible opt-in, fallback, or justification in this file. The policy requires flagging language or locale constraints when the skill appears to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for pandas allows future minor and patch releases to be installed without review, which can introduce vulnerable or malicious upstream versions through the software supply chain. In a package manifest, this weakens build reproducibility and makes it harder to verify exactly what code will execute when the skill is installed.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"author": "OpenClaw",
  "license": "MIT",
  "dependencies": {
    "pandas": "^2.0.0",
    "requests": "^2.31.0",
    "beautifulsoup4": "^4.12.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for requests permits automatic selection of newer releases that have not been explicitly vetted, creating a supply-chain risk if a compromised or vulnerable version is published. This is especially relevant for a data-fetching skill because requests is likely central to network operations.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "pandas": "^2.0.0",
    "requests": "^2.31.0",
    "beautifulsoup4": "^4.12.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The manifest allows any compatible beautifulsoup4 release via a caret range, so installation may pull in an affected version if the upstream package is compromised or vulnerable. Because there is already a known advisory associated with beautifulsoup4 in this ecosystem, leaving the version unpinned materially increases uncertainty and risk.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"dependencies": {
    "pandas": "^2.0.0",
    "requests": "^2.31.0",
    "beautifulsoup4": "^4.12.0"
  }
}

Unverifiable Dependency: beautifulsoup4 has 1 known advisory(ies) (MAL-2025-3615 (Malicious code in beautifulsoup4 (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The package references beautifulsoup4 without pinning, while static analysis reports a known advisory for that package in the npm ecosystem. Even if the exact installed version is unknown, this uncertainty is itself dangerous because consumers may resolve to a malicious or affected release at install time.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and increasing supply-chain risk if a newly released or compromised version is fetched. In a security-sensitive skill, this can indirectly introduce vulnerable or malicious code without any manifest change.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
pandas
requests
beautifulsoup4

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
77% confidence
Finding

Pandas has known advisories in some versions, and because the manifest does not specify a version, it is impossible to verify whether installation will land on a safe release. This does not prove an exploitable vulnerable version is present, but it is still a real security weakness because the dependency state is unverifiable and may resolve to an affected build.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The requests dependency is unpinned, allowing future installs to pull different releases, including ones with security regressions or newly introduced malicious packages in the supply chain. Because requests commonly handles outbound HTTP and may process credentials, version drift here is more security-relevant than for a purely local utility library.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
pandas
requests
beautifulsoup4

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Requests has multiple historical advisories, and the absence of version pinning means the environment may install an affected release without visibility or review. Given that requests is often used for network access, redirects, authentication, and TLS-sensitive workflows, uncertainty around its version is more dangerous in practice than a typical utility dependency.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The beautifulsoup4 dependency is unpinned, which creates non-reproducible environments and exposes the skill to supply-chain instability if future releases introduce vulnerabilities or breaking behavior. While not an immediate exploit by itself, it weakens dependency integrity and makes secure review harder.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
pandas
requests
beautifulsoup4

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The package description is written only in Chinese ("云梦A股数据获取Skill"), which indicates a fixed language presentation without any stated user choice or opt-in. The policy for this category flags language or locale constraints when they are imposed without offering an alternative or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.