ClawHub

ifind-finance-data/同花顺金融数据

Security checks across malware telemetry and agentic risk

Overview

This finance-data skill matches its stated purpose, but it disables HTTPS certificate checks while sending a user auth token to a remote API.

Review before installing. Only use this with an iFinD token if you trust the publisher and are comfortable editing or fixing the helper clients to validate TLS certificates; broad triggers may also cause this provider to be used for ordinary finance queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use local scripts (`call.py`, `call-node.js`), read a local configuration file containing an `auth_token`, and make outbound network requests, but it does not declare permissions for file access or networking. This creates a transparency and policy-enforcement gap: an agent or platform may invoke sensitive capabilities without users or reviewers having explicit permission metadata to evaluate or constrain them.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The code sets rejectUnauthorized: false on outbound HTTPS requests, disabling TLS certificate validation for a financial-data API that carries an authorization token and request contents. This enables man-in-the-middle interception or tampering with authenticated traffic, which is especially dangerous in a finance-related integration where integrity and confidentiality matter.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger list contains broad terms such as 'financial data', 'market data', '股票查询', and '金融资讯', which are likely to appear in many ordinary finance-related conversations. Overly broad triggers increase the chance of unintended skill invocation, which can lead to unnecessary external requests, accidental use of stored credentials, or retrieval of financial/news data when the user did not explicitly request this skill.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal