ClawHub
Back to skill

Security audit

Sector Scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese A-share market scanner with ordinary install and network-data risks, but no evidence of hidden access, credential theft, persistence, or destructive behavior.

Install and run this only in an isolated Python environment, pin or review the pytdx dependency if possible, and treat the market rankings as unauthenticated informational output rather than investment advice or integrity-protected financial data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-22
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

text
C:\Users\xfb\.workbuddy\binaries\python\versions\3.13.12\python.exe -m venv C:\Users\xfb\.workbuddy\binaries\python\envs\default
C:\Users\xfb\.workbuddy\binaries\python\envs\default\Scripts\pip install pytdx

Technical Analysis

The setup procedure installs pytdx without a version constraint, dependency lockfile, package hash, or explicit trusted repository. Consequently, the package resolved during installation may differ from the version reviewed or tested by the project.

This creates a supply-chain risk. If the package, one of its transitive dependencies, or the selected package repository is compromised, a malicious release could be installed. Malicious package code could execute during installation or when pytdx is imported by scripts/tdx_client.py.

Attack Path

  1. An attacker compromises the pytdx distribution account, its build pipeline, a transitive dependency, or the package repository used by pip.
  2. The attacker publishes a malicious release that still satisfies the unconstrained package name.
  3. A user follows the documented setup procedure and runs pip install pytdx.
  4. Pip resolves and installs the attacker-controlled release.
  5. Malicious code executes during package installation or when the scanner imports pytdx.hq.
  6. The malicious package operates with the permissions of the user running the installation or scanner.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution with the current user's privileges. Depending on that user's permissions, the malicious dependency could read or modify accessible files, access user-level credentials, initiate network connections, alter scan results, or tamper with the Python environment.

The project does not request administrative privi ...[truncated 123 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin pytdx and every transitive dependency to reviewed versions in a lockfile.
  2. Use a hash-verified requirements file, for example:
    text
    pytdx==REVIEWED_VERSION --hash=sha256:REVIEWED_PACKAGE_HASH
  3. Install with pip install --require-hashes -r requirements.txt.
  4. Explicitly configure the approved package index and disable unintended extra indexes.
  5. Review dependency release signatures, package ownership changes, and vulnerability advisories before updating.
  6. Run the scanner in an isolated virtual environment under a non-privileged account.
  7. Add automated dependency scanning and require review for lockfile updates.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/tdx_client.py:15
Finding

Unauthenticated Plaintext Market-Data Transport

Content
View full analysis

Vulnerability Details

File Location: scripts/tdx_client.py:15-24 and scripts/tdx_client.py:102-121; related TDX endpoints are configured in config/settings.json:8-30
Vulnerability Type: Plaintext and unauthenticated external data transport
Risk Level: Low

Vulnerable Code

python
SINA_PAGE_SIZE = 80
SINA_COUNT_URL = (
    "http://vip.stock.finance.sina.com.cn/quotes_service/api/json_v2.php/"
    "Market_Center.getHQNodeStockCount"
)
SINA_LIST_URL = (
    "http://vip.stock.finance.sina.com.cn/quotes_service/api/json_v2.php/"
    "Market_Center.getHQNodeData"
)
python
def _open_json_url(url: str, params: dict, timeout: int):
    full_url = f"{url}?{urllib.parse.urlencode(params)}"
    request = urllib.request.Request(
        full_url,
        headers={
            "User-Agent": "Mozilla/5.0",
            "Referer": "http://finance.sina.com.cn/",
        },
    )
    last_error: Exception | None = None
    for attempt in range(3):
        try:
            with urllib.request.urlopen(request, timeout=timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except Exception as exc:
            last_error = exc
            if attempt < 2:
                time.sleep(0.4 * (attempt + 1))
    raise RuntimeError(f"Sina stock list fetch failed: {last_error}")

The configured TDX servers also use direct host and port connections:

json
"tdx_servers": [
  {
    "name": "server_1",
    "ip": "119.6.200.40",
    "port": 7709
  },
  {
    "name": "server_2",
    "ip": "182.140.139.191",
    "port": 7709
  },
  {
    "name": "server_3",
    "ip": "218.200.222.134",
    "port": 7709
  },
  {
    "name": "server_4",
    "ip": "182.150.28.166",
    "port": 7709
  }
]

Technical Analysis

The Sina fallback uses HTTP rather than HTTPS. It therefore provides neither c ...[truncated 2018 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the Sina URLs and Referer with HTTPS endpoints supported by the provider.
  2. Reject redirects that downgrade an HTTPS request to HTTP.
  3. Use the platform certificate store and retain TLS certificate and hostname verification.
  4. Validate response schemas, expected content types, response-size limits, stock-code formats, field lengths, page counts, and numeric bounds before accepting data.
  5. Prefer an authenticated market-data API or a secure tunnel for TDX traffic where available.
  6. Document that unauthenticated TDX data must not be treated as integrity-protected financial data.
  7. Add provenance and transport-security status to results so users can distinguish authenticated data from fallback data.
  8. Fail safely or require explicit user approval before using a plaintext fallback.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill invokes Python, installs a package with pip, reads local configuration, writes CSV output, and connects to external TDX quote servers, but it declares no explicit tool scope or permission boundaries. This creates an overbroad and ambiguous execution surface where an agent may grant file and network capabilities implicitly, increasing the risk of unintended local file access, package-install side effects, or outbound connections beyond what users expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all instructions, labels, and descriptions exclusively in Chinese, with no indication that the skill is region-specific or that users may opt into another language. Under the language/locale policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code emits natural-language output in Chinese via HEAT_LABEL_CN and the _sector_flow_label return values, but there is no indication that the user can choose a language or that the locale restriction is documented and justified. That creates a language/locale policy concern because the skill appears to force a specific language in its output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file contains multiple user-visible string mappings and status labels exclusively in Chinese, including flow labels, heat labels, and scoring detail text. Because the skill does not provide a language/locale option or document that it is intentionally region-specific, it may violate language/locale policy by forcing a specific language on users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code fetches stock list data from Sina over plain HTTP, which allows any network attacker on the path to tamper with or observe responses. Because the returned JSON is used to build the A-share universe and later influences quote scanning and exported results, a man-in-the-middle could inject, suppress, or alter symbols and names, causing integrity issues and misleading analytics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON configuration uses Chinese natural-language sector and stock names throughout the file, with no indication that the skill is region-specific or that users can opt into a Chinese locale. Under the policy, forcing a specific language without user choice can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The docstring, usage examples, and help-facing descriptions are presented only in Chinese, which can amount to a language/locale policy issue when no user opt-in or alternative language is offered. There is no visible indication that the skill is intentionally restricted to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.