Security audit

AI全栈量化 Master

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent quant-trading guide, but it normalizes live automated trading and privileged installation steps without enough safety controls.

Install only if you are comfortable auditing the deployment steps and running it first in an isolated paper-trading environment. Do not pipe remote installers directly into a shell, avoid administrator/global installs where possible, pin and verify dependencies, keep Feishu/QMT secrets out of command history, change default database credentials, and require explicit human approval before any live order is sent.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:87
Finding: Unverified Remote Installation Scripts Are Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:98
Finding: Unpinned Packages and Plugins Create Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:260
Finding: Feishu Application Secret Is Supplied Through the Command Line
Content: View full analysis
``` The deployment guide repeats the same pattern: ```bash openclaw config set channel.feishu.appSecret ``` ### Technical Analysis The instructions encourage replacing the placeholder with a real application secret as a command-line argument. Command-line secrets can be retained in shell history and terminal transcripts. Depending on the operating system and execution environment, they may also be observable through process inspection, endpoint telemetry, audit logs, crash reports, or copied troubleshooting output. Although the repository does not contain a real Feishu secret, the documented configuration method creates a predictable disclosure channel when followed by a user. ### Attack Path 1. A user replaces the placeholder with the real Feishu App Secret. 2. The shell stores the complete command in command history, or monitoring systems capture the command line. 3. Another local user, administrator, support operator, log consumer, or compromised process reads the recorded command. 4. The attacker extracts the App Secret. 5. The attacker uses the credential to impersonate or abuse the Feishu application within its granted permissions. ### Impact Assessment Exposure can allow unauthorized access to the Feishu application and any capabilities granted to it. The documented permissions include messaging, chat access events, and document access. The exact impact depends on Feishu-side configuration and tenant controls but may include application impersonation, unauthorized messaging, metadata access, or access to permitted documents and conversations. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/questdb.md:71
Finding: QuestDB Example Uses Published Default Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (24)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly promotes '实盘交易' and automated order execution but does not place a prominent, explicit warning near the feature description that real-money automated trading can cause immediate financial loss, unintended orders, or compliance issues. In this context, the absence of strong safety gating is dangerous because the skill targets end-to-end deployment and 7×24 automation, which increases the chance users will connect live broker accounts and run code with insufficient review.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The command 'curl -fsSL https://openclaw.sh/install.sh | bash' fetches code from a remote endpoint and executes it immediately, preventing meaningful review and making supply-chain compromise highly impactful. Because this skill also covers bot deployment, credentials, and live trading workflows, successful abuse could lead to host takeover, secret theft, or tampering with automated trading agents.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
openclaw gateway start

或使用官方一键部署

curl -fsSL https://openclaw.sh/install.sh | bash

text
### 第四步：安装Python依赖

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The shell pipeline into 'bash' is a classic chaining-abuse pattern because it turns network content directly into executable commands with no integrity or content validation step. In the context of an automation/trading skill, this raises the danger substantially: compromise can cascade into bot control, credential exfiltration, persistence, and potentially unauthorized order placement.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
openclaw gateway start

或使用官方一键部署

curl -fsSL https://openclaw.sh/install.sh | bash

text
### 第四步：安装Python依赖

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
md
- 每个技能包含 `SKILL.md` 主文档

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: curl -fsSL https://openclaw.sh/install.sh | bash is a classic external script fetching pattern that executes code directly from the network. In a deployment guide, this increases risk because it targets real installation environments, where successful exploitation gives immediate code execution on the user's machine or server.
Content: Scanner excerpt · references/openclaw-deploy.md (reported line 37)May include surrounding context.
md
openclaw gateway start # 方式二：官方一键脚本 curl -fsSL https://openclaw.sh/install.sh | bash # 方式三：无影云桌面（可视化Linux） # 参考官方MumeCloud部署教程

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The | bash chain converts fetched content into immediate command execution, eliminating any review boundary between download and execution. This makes the instruction especially unsafe because a transient compromise or malicious response is enough to run attacker-controlled commands on the host.
Content: Scanner excerpt · references/openclaw-deploy.md (reported line 37)May include surrounding context.
md
openclaw gateway start # 方式二：官方一键脚本 curl -fsSL https://openclaw.sh/install.sh | bash # 方式三：无影云桌面（可视化Linux） # 参考官方MumeCloud部署教程

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The markdown describes a skill capable of executing financial trades but omits warnings about financial loss, irreversible market actions, credential sensitivity, and the need for human approval. In this skill context, omission of safety guidance is dangerous because the documented capability is operational and high impact, not merely informational.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The QMT trading example presents generic natural-language triggers like buying and selling without any stated invocation boundaries, confirmation step, or authorization guard. In a skills ecosystem where agents may invoke skills from user phrasing, such ambiguous high-impact commands increase the chance of unintended or prompt-induced trade execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installation section instructs users to execute remote scripts directly via PowerShell/Bash, which is an unsafe pattern because it runs unreviewed code fetched over the network with user privileges. This is especially risky in an agent/automation skill because users are encouraged to set up trading, bots, and credentials on the same host, so compromise could expose secrets or enable malicious trade execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
sql
-- 创建因子宽表 CREATE TABLE factor_wide_table ( symbol STRING, trade_date TIMESTAMP, obv DOUBLE,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill shows direct configuration of Feishu appId and appSecret without an explicit warning about secret handling, storage, rotation, and avoiding logs or shell history leakage. In a multi-agent trading/bot environment, exposed messaging credentials can let an attacker impersonate the bot, intercept workflow messages, or manipulate operations through the collaboration channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs an agent to execute buy/sell orders and push reports to Feishu, but it does not include any user-facing warning, confirmation gate, sandbox restriction, or dry-run default for these real-world side effects. In an agent framework, operational instructions like these can be acted on automatically, creating a meaningful risk of unauthorized trading, accidental financial loss, and unintended disclosure through outbound messaging.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function optimize_parameters is documented as optimizing rebalance period and stock count, and its loop clearly attempts to vary hold_days and top_n. However, it calls run_backtest with hold_days and top_n keyword arguments even though run_backtest only accepts data_dict and initial_cash, so the advertised optimization behavior cannot occur as written.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and user-facing guidance are entirely in Chinese, and the runtime print messages are also Chinese-only. This constitutes a language/locale policy issue because the skill does not offer an opt-in choice of language or explain that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/multi-agent.md (reported line 42)May include surrounding context.
bash
# 创建新Agent openclaw agent create <agent-name> # 列出所有Agent openclaw agent list

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/multi-agent.md (reported line 42)May include surrounding context.
bash
# 创建新Agent openclaw agent create <agent-name> # 列出所有Agent openclaw agent list

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document describes an automated intraday workflow that reads local signal files, dispatches work to multiple agents, generates reports, and culminates in trade execution, but it does not include strong warnings, approval gates, or safe-mode guidance. In a multi-agent trading context, omission of explicit human confirmation and safeguards can normalize autonomous impactful actions and increase the chance of unintended orders or unsafe file operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to fetch and immediately execute a remote PowerShell installer via iwr ... | iex, which runs network-delivered code without review, integrity verification, or pinning to a specific trusted release. If the source, repository, DNS, TLS termination, or distribution path is compromised, users could execute arbitrary code with administrator privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation tells users to pipe a downloaded shell script directly into bash, which executes unreviewed remote code immediately. This is dangerous because any compromise of the hosting domain, repository, or delivery chain can lead to arbitrary command execution on the target Linux host.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Lines L089-L092 list triggers such as “分析股票” and especially “查询行情,” which are common natural-language requests and are not bounded by context, exclusions, or negative examples. Because this markdown is guidance for writing SKILL.md files, these examples promote ambiguous activation behavior rather than clearly delimiting when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's natural-language docstring and comments are entirely in Chinese, with no indication that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file presents all instructions, headings, and code explanations in Chinese only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is entirely written in Chinese, including headings, explanations, and code comments, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill file is written only in Chinese, including the title and all instructions, with no indication that another language is available or that Chinese is required for a region-specific purpose. This can violate a language/locale policy when users are not given an explicit language choice or opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

External Script Fetching

或使用官方一键部署

Chaining Abuse

或使用官方一键部署

Ae1

External Script Fetching

Chaining Abuse

Missing User Warnings

Vague Triggers

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations

Session Persistence

Session Persistence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Static analysis