ClawHub
Back to skill

Security audit

Mx Selfselect

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it can change an authenticated financial watchlist from free-form input and handles account data with limited safeguards.

Review before installing. Use it only if you trust the Eastmoney API key workflow, keep MX_APIKEY out of shared project files, use a private output directory, and be careful with natural-language commands because non-query text may modify your watchlist without a separate confirmation step.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mx_self_select.py:144
Finding

Financial account data is written with ambient filesystem permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Third-party dependency is not reproducibly pinned

Content
View full analysis
=2.31.0 ``` ### Technical Analysis The requirement accepts version `2.31.0` or any later release of `requests`. It does not impose an upper bound, pin an audited exact version, or provide an artifact hash. As a result, installations performed at different times can resolve to different code. If the configured package index, dependency-resolution environment, or a future accepted release is compromised, unreviewed code can enter the execution environment. This finding does not establish that the current `requests` package is malicious; it identifies the absence of reproducible dependency and integrity controls. ### Attack Path 1. An operator installs dependencies using `pip install -r scripts/requirements.txt`. 2. The package resolver selects the newest compatible release available from the configured index rather than a specifically audited artifact. 3. A compromised index, malicious mirror, or compromised future package release supplies altered code. 4. The altered package is installed and imported by `mx_self_select.py`. 5. Malicious package initialization or runtime behavior executes with the permissions and environment of the user running the Skill. ### Impact Assessment A compromised dependency could execute arbitrary Python code under the Skill process account. That code could access the `MX_APIKEY` environment variable, read files available to that account, alter API requests, or tamper with generated results. The practical likelihood is reduced when installation exclusively uses the official Python Package Index and trusted releases, but the current requirement does not enforce either artifact identity or reproducibility. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (13)

Tainted flow: 'headers' from os.environ.get (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 62)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Tainted flow: 'headers' from os.environ.get (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 81)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

Falling back to a repo-adjacent .env file for API credentials increases the chance that long-lived secrets are stored insecurely on disk, accidentally committed, or exposed to other local users/processes. In this skill, those credentials authorize account-backed watchlist actions, so compromise could let an attacker query or modify the user's self-selected stocks.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 33)May include surrounding context.

python
apikey = os.environ.get("MX_APIKEY", "")
    if not apikey:
        # 尝试从.env文件读取
        env_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_file):
            try:
                with open(env_file, "r") as f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents access to environment variables, filesystem output, and external network endpoints, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where the runtime may grant broader capabilities than reviewers or users expect, increasing the chance of unintended data access, credential use, or exfiltration through network/file operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes a stock watchlist management skill that supports querying, adding, and deleting favorites. While calling backend APIs is expected, proactively reading secrets from environment variables and traversing to a local .env file introduces credential-access behavior beyond the user-facing purpose described in the manifest.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 62)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 81)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language input is routed directly into state-changing add/delete operations without a confirmation step, dry-run preview, or stricter intent validation. In an agent setting, ambiguous or adversarial prompts could cause unintended modification of a user's watchlist, which is especially risky because the action affects an authenticated account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language content of the skill file is entirely Chinese, and the document does not indicate that users can choose another language or that the skill is restricted to a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill inconsistently refers to the API key as both MX_APIKEY and EASTMONEY_APIKEY. This mismatch can cause operators to place secrets in the wrong variable or break expected secret-handling controls, leading to failed authentication, accidental disclosure during debugging, or insecure ad hoc workarounds.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module docstring presents the skill's user-facing description entirely in Chinese, which may impose a language choice without offering localization or opt-in. Under the stated policy, forcing a specific language can be a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified as requests>=2.31.0, which allows any future version to be installed and prevents reproducible builds. This creates supply-chain risk because a later vulnerable or breaking release could be pulled in without review, and in a skill that may handle account and market data, dependency behavior matters for confidentiality and integrity.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest references requests without pinning an exact version, while known advisories exist for some releases of that package. Because the installed version is not fixed, it is impossible to verify from this file alone whether deployment will use a patched or vulnerable release, leaving a supply-chain exposure window.

Content

No source excerpt is available for this finding.