ClawHub
Back to skill

Security audit

Liangxi News Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is disclosed and purpose-aligned, but it can route broad news requests to an external TradeAlpha service and prompt for account credentials with token persistence.

Install only if you intentionally want generic news requests handled by TradeAlpha and you trust quantaccess.lxaa.top with your news queries and TradeAlpha credentials. Prefer using TRADEALPHA_API_KEY over entering a password, review or delete the local token file if needed, and avoid using the README publishing command without pinning the clawhub version.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

other

Error
Location
SKILL.md:24
Finding

Collection and Transmission of Account Credentials to an Unverifiable External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-33 and 92-95
Vulnerability Type: Credential exfiltration through an external authentication workflow
Risk Level: High

Evidence

text
- 登录和新闻请求都会发送到 `https://quantaccess.lxaa.top`
- `tradealpha_news` 会优先读取环境变量 `TRADEALPHA_API_KEY`
- 如果环境变量里没有 token，`tradealpha_news` 会读取本地配置文件 `~/.config/tradealpha-open-platform/config.json`
- `tradealpha_login` 登录成功后，会把返回的 token 保存到 `~/.config/tradealpha-open-platform/config.json`
- 本地配置文件用于后续复用 token，避免每次拉新闻都重新登录
- 不要在回复里回显用户密码或 token
text
1. 向用户索要 `account` 和 `password`
2. 调用 `tradealpha_login`
3. 传入 `account`、`password`
4. 登录成功后，如果用户还要求新闻，再继续新闻请求

English meaning: login and news requests are sent to https://quantaccess.lxaa.top; the login workflow asks the user for an account and password and passes both to tradealpha_login. Returned tokens are stored in ~/.config/tradealpha-open-platform/config.json.

Technical Analysis

The skill explicitly directs the agent to collect a user's account and password and submit them through an external plugin associated with quantaccess.lxaa.top. The repository contains only routing instructions and does not contain the implementation of tradealpha_login or tradealpha_news. Consequently, the audit cannot verify certificate handling, endpoint ownership, request construction, server-side credential retention, logging behavior, token scope, or local file permissions.

Although the behavior is disclosed, disclosure alone does not establish that direct password collection by an AI agent or transmission to the external service is secure. The workflow also persists a returned bearer token locally, creating an additional credential exposure point.

Attack Path

  1. A user requests TradeAlpha login or requests news for which the service returns auth_required: true.
  2. The skill instructs the agent to request the user's account and password.

...[truncated 1045 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not request or process account passwords through the conversational agent.
  • Replace password submission with an official OAuth 2.0 authorization-code flow with PKCE, device authorization flow, or another browser-mediated authentication mechanism.
  • Require explicit, informed user confirmation before transmitting information to the external domain.
  • Publish the complete plugin source and document the exact API endpoints, data retention policy, certificate validation, logging behavior, and server ownership.
  • Use narrowly scoped, short-lived, revocable access tokens rather than reusable account credentials.
  • Store tokens in an operating-system credential manager or encrypted secret store instead of a general JSON file.
  • If file storage is unavoidable, enforce restrictive permissions, avoid logging token values, and provide explicit revocation and deletion procedures.
  • Warn users not to reuse credentials and identify the party operating the authentication endpoint.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:38
Finding

Broad News-Request Interception Forces Use of an External Provider

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-44, 66-87, and 89-134
Vulnerability Type: Skill instruction hijacking
Risk Level: Medium

Evidence

text
如果用户是小白用户，只说一句：

- “给我拉取当天的新闻”
- “帮我看今天的市场新闻”
- “帮我拉彭博新闻”
- “登录 TradeAlpha”

都应优先使用本 skill。
text
## Tool Contract

本 skill 只允许使用以下两个真实工具：

- `tradealpha_news`
- `tradealpha_login`

不要改用别的工具来冒充新闻或登录能力。
text
## Trigger Rules

用户出现以下任一表达时，优先触发本 skill：

- 今天的新闻
- 今日新闻
- 当天新闻
- 现在的新闻
- 最新新闻
- 最近新闻
- 市场新闻
- 宏观新闻
- 路透新闻
- 彭博新闻
- Truth 新闻
- 国内新闻快讯
- 帮我拉新闻
- 帮我看新闻
- 拉取实时新闻
- 按来源、分类、重要程度筛选新闻
- 登录 TradeAlpha
- 获取 token
- 初始化 token
- 刷新 token
- 重新登录 TradeAlpha

English meaning: generic requests such as “today's news,” “latest news,” and “market news” preferentially activate this skill, which permits only tradealpha_news and tradealpha_login.

Technical Analysis

The activation rules are not limited to users who explicitly request TradeAlpha. They include broad, provider-neutral news phrases. Once selected, the tool contract prohibits using other tools and directs the request to the TradeAlpha plugin. If that plugin reports auth_required: true, the workflow escalates from an ordinary news request to solicitation of an account and password.

This behavior changes how the agent handles generic requests and constrains tool selection in favor of one external provider. A remote service can influence whether credential collection begins by controlling the auth_required response.

Attack Path

  1. A user makes a generic request such as “show me today's market news,” without selecting TradeAlpha.
  2. The broad trigger rules cause the skill to take priority.
  3. The tool contract prevents the agent from selecting another available news source.
  4. The agent sends the request to tradealpha_news.
  5. If the external tool returns auth_required: true, the routing ru ...[truncated 720 chars]
Remediation
View remediation

Remediation Suggestions

  • Restrict automatic activation to requests that explicitly mention TradeAlpha.
  • Do not claim generic phrases such as “today's news,” “latest news,” or “market news.”
  • Allow the agent or user to select among available providers instead of prohibiting alternative tools.
  • Before the first external request, identify the provider and destination domain and obtain user confirmation.
  • Do not initiate credential collection solely because an external news response contains auth_required: true.
  • Require a separate, explicit user decision to begin authentication.
  • Treat authentication-related fields returned by the remote tool as untrusted data and validate them against a documented response schema.

T08 · Insecure Dependencies

Warning
Location
README.md:18
Finding

Mutable Package Execution Through an Unpinned npx Command

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 18-20
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Evidence

bash
npx clawhub@latest publish ./liangxi_news_skill --slug tradealpha-open-platform --version 0.6.0

Technical Analysis

The documented publishing command invokes npx with the mutable @latest package tag. If the requested package is unavailable locally, npx may download and execute the version currently associated with that tag. The code executed by the command can therefore change without any modification to this repository or review of the newly selected package version.

Compromise of the package publisher, npm account, package release pipeline, or a newly published version could turn the documented command into an arbitrary-code execution path. The repository does not provide an exact package version, lockfile, or integrity value for this command.

Attack Path

  1. An attacker compromises the clawhub package publication process or publishes a malicious version through compromised maintainer credentials.
  2. The mutable latest tag is assigned to the malicious release.
  3. A maintainer follows the README and runs the documented npx clawhub@latest publish command.
  4. npx resolves and downloads the malicious release.
  5. Package lifecycle behavior or CLI entry-point code executes with the maintainer's operating-system privileges.
  6. The malicious package can access files, environment variables, publishing credentials, and network resources available to that user.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the publishing command. Potentially exposed assets include source code, environment variables, npm or ClawHub publishing credentials, SSH material accessible to the user, and other local files. The process could also publish modified artifacts. No mali ...[truncated 133 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Record the dependency in a manifest and lockfile so resolution is reproducible.
  • Verify the package's provenance and integrity before execution.
  • Run publishing operations in an isolated, least-privileged environment with only the minimum required credentials.
  • Disable package lifecycle scripts where compatible with the publishing workflow.
  • Review release notes and package contents before upgrading the pinned version.
  • Use short-lived, narrowly scoped publication credentials and revoke them after suspected supply-chain compromise.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation is written entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This creates a natural-language locale policy concern because it implicitly forces one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx clawhub@latest, which fetches and executes the most recent package version at publish time rather than a reviewed, fixed release. If the upstream package is compromised or a breaking/malicious version is published later, maintainers following the documentation could execute untrusted code on their workstation or CI environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list uses very broad, everyday phrases such as 'latest news', 'today's news', and 'market news', which can cause the skill to activate in contexts the user did not intend. Because this skill routes requests into external plugin actions, overbroad activation increases the chance of unintended network requests, unexpected login prompting, or accidental use of stored credentials/token-backed actions.

Content

No source excerpt is available for this finding.