ClawHub
Back to skill

Security audit

fund-monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill does monitor funds, but it also contains hardcoded Feishu credentials and can upload sensitive portfolio summaries to a fixed Feishu document that the main skill documentation does not disclose.

Review carefully before installing. This skill can query fund data, but it also bundles private-looking portfolio values and Feishu credentials and can publish financial summaries to a preconfigured Feishu document. Install only if you understand and trust that destination, rotate/remove the embedded credentials, and prefer a local-only version or one requiring your own explicitly configured export target.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
append-fund.js:9
Finding

Hard-Coded Feishu Credentials and Document Token

Content
View full analysis
{ const data = JSON.stringify({ app_id: FEISHU_APP_ID, app_secret: FEISHU_APP_SECRET }); const options = { hostname: 'open.feishu.cn', path: '/open-apis/auth/v3/tenant_access_token/internal', method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': data.length } }; const req = https.request(options, (res) => { let body = ''; res.on('data', (chunk) => body += chunk); res.on('end', () => { try { const result = JSON.parse(body); resolve(result.tenant_access_token); } catch (e) { reject(e); } }); }); ``` ### Technical Analysis The package distributes a Feishu application ID, application secret, and fixed document ...[truncated 1997 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
append-fund.js:18
Finding

Undisclosed Transmission of Sensitive Portfolio Information to a Fixed Feishu Document

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
fund_monitor_v2.py:11
Finding

Personal Portfolio Holdings and Cost Bases Embedded in Distributable Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The analyzed behavior includes authenticating to Feishu APIs, appending content to a specified document, using hardcoded third-party credentials and document identifiers, and relying on pre-supplied summaries rather than actually retrieving fund prices. This is especially dangerous in a fund-monitoring skill because it combines deceptive functionality with credential exposure and silent external writes, creating risks of unauthorized API use, data leakage, and abuse of linked documents.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The analyzed behavior includes authenticating to Feishu APIs, appending content to a specified document, using hardcoded third-party credentials and document identifiers, and relying on pre-supplied summaries rather than actually retrieving fund prices. This is especially dangerous in a fund-monitoring skill because it combines deceptive functionality with credential exposure and silent external writes, creating risks of unauthorized API use, data leakage, and abuse of linked documents.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The analyzed behavior includes authenticating to Feishu APIs, appending content to a specified document, using hardcoded third-party credentials and document identifiers, and relying on pre-supplied summaries rather than actually retrieving fund prices. This is especially dangerous in a fund-monitoring skill because it combines deceptive functionality with credential exposure and silent external writes, creating risks of unauthorized API use, data leakage, and abuse of linked documents.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The analyzed behavior includes authenticating to Feishu APIs, appending content to a specified document, using hardcoded third-party credentials and document identifiers, and relying on pre-supplied summaries rather than actually retrieving fund prices. This is especially dangerous in a fund-monitoring skill because it combines deceptive functionality with credential exposure and silent external writes, creating risks of unauthorized API use, data leakage, and abuse of linked documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends portfolio snapshot data to a Feishu document by appending content, which is a write-side data exfiltration capability not implied by a skill described only as fund monitoring/querying. It expands the blast radius from local observation to persistent third-party storage of financial data, increasing privacy and unauthorized disclosure risk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · append-fund.js (reported line 60)May include surrounding context.

js
print("No fund data found")
        return
    
    # 获取access token
    token = get_access_token()
    
    # 构建新增内容

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file contains hardcoded Feishu app credentials and a document token in source code. Anyone with repository or artifact access can reuse these secrets to obtain access tokens, write to the target document, and potentially abuse the associated Feishu application, leading to unauthorized access and data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill manifest describes fund monitoring, but this file performs a write operation to an external Feishu document, creating a hidden data-exfiltration or unauthorized side-effect capability. Even if intended for reporting, silently sending investment/account summaries to a third-party document exceeds the declared scope and can leak sensitive financial information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares no explicit tool scope even though the analyzed behavior indicates file-read and network capabilities. This is dangerous because users and the runtime cannot reliably constrain what the skill may access, increasing the risk of unintended data access or outbound exfiltration through hidden or undeclared operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the entire user-facing documentation are written only in Chinese, with example invocations also requiring Chinese phrasing. Under the policy, a skill should not force a specific language unless it offers user choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code contains Feishu app credentials and uses them to obtain a tenant access token, enabling document modification capability unrelated to basic monitoring. Embedding and exercising write-capable third-party credentials in a monitoring skill creates unnecessary privilege and can be abused to alter or store sensitive user financial information externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · append-fund.js (reported line 17)May include surrounding context.

js
import requests
    url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    data = {"app_id": APP_ID, "app_secret": APP_SECRET}
    resp = requests.post(url, json=data)
    return resp.json().get("tenant_access_token")

def get_fund_data():

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script transmits account snapshot details including principal, market value, and profits to Feishu without clear user notice or consent at the point of transmission. Silent export of financial data undermines user expectations and can lead to privacy violations even if the destination is an intended workspace.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This network request sends financial account summary data to a remote Feishu document, creating an external data transfer path for sensitive information. In the context of a monitoring skill, this is dangerous because it persists user financial data in a third-party service without strong indication of consent or necessity.

Content

Scanner excerpt · append-fund.js (reported line 41)May include surrounding context.

js
"doc_token": DOC_TOKEN,
        "content": content
    }
    resp = requests.post(url, json=data, headers=headers)
    return resp.json()

def main():

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring is written as a Chinese-only skill description, and all user-facing messages in the script are likewise hardcoded in Chinese. This indicates a language/locale constraint without any opt-in, choice, or justification that the skill is intended only for Chinese-speaking users or a China-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module description and all user-facing output strings are in Chinese, which imposes a specific language on users. The file does not offer opt-in language selection or document that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill goes beyond simple fund monitoring by combining hard-coded holdings with return calculations and explicit investment recommendations such as whether to hold or add positions. This creates a scope-expansion problem: users invoking a monitoring/query skill may unknowingly receive personalized financial guidance derived from embedded portfolio data, which is higher-risk and can lead to inappropriate reliance or unintended disclosure of sensitive financial context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code issues HTTP requests to Eastmoney for each fund code, transmitting the user's monitored fund list to an external service. Although the behavior is visible in code, there is no user-facing disclosure in comments, docstrings, or runtime messaging warning that portfolio-related data is being sent over the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script performs an external publishing action by sending collected fund data to a Feishu update script, which exceeds a narrow interpretation of a skill described only as querying and monitoring funds. This creates a data-flow and side-effect boundary not clearly disclosed in the skill purpose, increasing the risk of unintended data exfiltration, unauthorized document modification, or misuse if the downstream script or its credentials are compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code appends content to a Feishu document via an external API, which is a data-transfer capability not justified by a monitoring-only skill description. In the context of financial holdings and returns, such outbound writes can expose private account performance data to an external service or to an unintended document owner.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script uploads parsed financial/account summary data to Feishu automatically with no user confirmation or visible warning. Because the data includes principal, market value, profit, and performance metrics, silent transmission can disclose sensitive personal financial information without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The fallback function is documented as '获取基金数据' and returns only code/date/nav/daily_change/method, omitting 'name' and period change fields. In main(), the result is then treated as if it had the full schema and printed with data['name'] and change fields, which contradicts the implied documentation that this method provides equivalent fund data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module docstring advertises investment advice while the manifest says the skill only supports monitoring and querying. This mismatch is dangerous because it conceals higher-risk behavior from reviewers and users, weakening informed consent and governance over what the skill actually does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
31% confidence
Finding

The inline documentation emphasizes fund monitoring, while the script also performs a downstream publication step to Feishu. Although not a strong contradiction at the line level, the documentation framing understates that the script pushes data into an external collaboration platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Comments, parsing patterns, and output content are written exclusively in Chinese, which effectively forces a specific language/locale in the skill's user-facing behavior. There is no opt-in, fallback, or documentation explaining that this is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.