Financial Ai Agent

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:33 AM UTC
• Version: 1.0.4

Overview

The skill is a coherent financial-quote lookup helper, but it asks users to paste an API key into chat and stores credentials in a local OpenClaw config file using disclosed but weak handling.

Review this skill before installing if you would use a personal Financial Agent API key. Prefer configuring secrets outside chat if OpenClaw supports it, avoid pasting sensitive keys into normal conversations, and be aware that the documented config command can overwrite existing custom settings in ~/.openclaw/openclaw.json. The external market-data API calls are expected for the skill's purpose, but the embedded shared trial key should not be treated as private.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46

Finding

Hardcoded Shared API Key Exposed in Skill Documentation

Content

View full analysis

Remediation

View remediation

&2 exit 1 } ``` 3. Replace documentation credentials with an unmistakable placeholder such as `YOUR_API_KEY`. 4. Revoke or rotate the exposed key if it was not expressly designed as a permanently public anonymous token. 5. If anonymous trial access is required, implement it server-side without distributing a reusable credential. Apply strict per-IP or per-installation rate limits and abuse monitoring. 6. Prefer a dedicated secret store or environment variable over plaintext configuration where supported. 7. Ensure configuration files containing user-specific keys have restrictive permissions, such as mode `0600`. 8. Add automated secret scanning to the publication workflow to prevent future credentials from being committed or packaged. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill goes beyond simple market-data lookup by instructing the agent to read from and write to the user's local OpenClaw config file to manage API credentials. This expands the skill's privilege boundary into local credential handling and file modification, increasing the chance of secret exposure, accidental overwrite, or misuse by an agent acting on natural-language instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to persist a user-supplied API key into ~/.openclaw/openclaw.json without emphasizing that a local file will be modified and a secret will be stored there. Having an agent perform credential writes based on conversational input creates risk of unintended file changes, insecure secret storage, and loss of user control over sensitive configuration.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly asks users to provide their API key in natural-language chat and then have the agent store it locally. Collecting secrets through normal conversation is dangerous because chat logs may be retained, inspected, or mishandled, and it conditions users to disclose credentials to the agent rather than using a secure secret-entry mechanism.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

FA_KEY=$(jq -r '.custom.financial_agent_key // "K6lncNNrMAahJccarH63P1ImRMIPCqq7"' ~/.openclaw/openclaw.json)

调用 API

curl -H "x-api-key: $FA_KEY" "https://api.financialagent.cc/api/v1/quotes/SH600519"

text

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill embeds a hard-coded shared default API key directly in the documentation and example commands. Shared embedded credentials are inherently unsafe because they normalize secret disclosure, can be abused by anyone who reads the skill, and may encourage the agent to transmit a credential to a third-party service without user-specific authorization.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The invocation description and user instruction examples require Chinese phrases such as 查询行情, 查腾讯, and 我的faa的key是..., with no indication that other languages are accepted. That can amount to a language-policy issue because the skill appears to force a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.