ClawHub
Back to skill

Security audit

国泰海通证券-灵犀自选股管理

Security checks for vulnerabilities and agentic risk

Overview

This brokerage watchlist skill is mostly coherent, but it handles persistent account credentials and device identifiers with broader-than-ideal scoping.

Install only if you trust the publisher and are comfortable authorizing a brokerage-account integration. After authorization, protect or remove the shared gtht-entry.json credential file when no longer needed, manage device bindings through the official brokerage/灵犀 flow, and carefully review any add or delete list before confirming.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares no permissions, yet its instructions require environment access and MCP-backed operations, including authorization state checks and shared-file handling. This under-declaration is dangerous because reviewers, policy engines, or users may treat the skill as lower-risk than it is, allowing sensitive operations to run without appropriate scrutiny or sandboxing.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a narrowly scoped watchlist manager, but its documented behavior includes cloud authorization flows, polling, storage of authorization artifacts, device information collection, and calls to broader gateway/tooling services. This scope mismatch is risky because it can hide credential handling, tracking, and broader service access behind an innocuous financial-management description, increasing the chance of overbroad execution and sensitive data exposure.

Static analysis

No suspicious patterns detected.