ClawHub
Back to skill

Security audit

Gold Price Inquiry - 黄金价格查询

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward gold-price lookup that uses a disclosed third-party API and API key, with no hidden persistence or destructive behavior found.

Install only if you are comfortable using a JisuAPI AppKey and sending gold-price query parameters to JisuAPI. Treat trend summaries as market-data explanations, not investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares environment-variable requirements and is explicitly designed to call an external API, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a host may not correctly gate network or secret access, and users may not understand that external requests and credential use are involved.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger language includes broad phrases like similar gold-price questions, which can cause over-activation outside the intended domain. Overly broad routing can send unrelated user queries to this skill and unnecessarily disclose user content to the external provider or produce misleading finance-related answers.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions include questions about future trends and what happens next, which overlap with broader investment-advice requests. In a financial context, ambiguous activation can cause the skill to answer speculative or advisory prompts using limited pricing data, increasing the chance of unsafe or noncompliant financial guidance.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation names JisuAPI as the data source but does not clearly warn users that their requests may be transmitted to a third-party service. Missing disclosure undermines informed consent and can expose potentially sensitive query content or usage patterns to an external provider without adequate notice.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests


BASE_URL = "https://api.jisuapi.com/gold"


def _call_gold_api(path: str, appkey: str, params: dict = None):
Confidence
84% confidence
Finding
https://api.jisuapi.com/

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.