ClawHub
Back to skill

Security audit

虾皮红利类指数投资分析

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent dividend-index analysis skill, but users should handle the required DaxiAPI token carefully.

Install only if you trust DaxiAPI and the `daxiapi-cli` package. Treat the API token as a secret: avoid pasting real tokens into chats or shared terminals, be aware command lines and CLI config may persist secrets, and rotate the token if it is exposed. Treat generated investment analysis as informational, not financial advice.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill instructs users to configure an API token in a CLI without warning how the credential is stored, who can access it, or that requests will be transmitted to an external service. This can lead to accidental credential exposure on shared systems or uninformed disclosure of query data to a third party, especially because the setup step is presented as routine and mandatory.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The documentation instructs users to set and retrieve an API token directly from the CLI without any warning about credential exposure, shell history leakage, local persistence, or avoiding token disclosure in shared environments. In a skill that encourages command-line use, this can lead users to paste long-lived secrets into terminals or display them on screen, increasing the risk of accidental credential compromise.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide instructs users to place a live API token directly in shell commands and CLI configuration without warning that command lines may be stored in shell history and local config files may persist secrets in plaintext or weakly protected storage. This can lead to credential disclosure on shared machines, through backups, terminal logs, screenshots, or history files, enabling unauthorized API use.

Static analysis

No suspicious patterns detected.