ClawHub
Back to skill

Security audit

大虾皮股市工具集

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed router and reference guide for A-share financial data APIs, with token-handling precautions users should still follow.

Install only if you intend to use daxiapi and related market-data services. Treat the API token as a secret, prefer temporary environment variables or a secure credential store when possible, and review any npx daxiapi-cli@latest command before running it because it executes a package fetched from the npm ecosystem.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to set an API token via CLI arguments or shell environment variables without warning that secrets may be exposed through shell history, process listings, terminal logs, or persisted shell startup files. Because this skill is specifically designed to onboard users to an external financial data API, the omission increases the chance of credential leakage during normal use.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document instructs users to authenticate with a bearer token and includes multiple third-party API endpoints, but it does not provide any guidance on secure token storage, avoiding token exposure in client-side code, or the privacy implications of sending requests to external services. In a skill that routes financial-data queries, this omission can lead users or downstream implementers to embed secrets unsafely or transmit sensitive usage patterns to outside providers without realizing the risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.