ClawHub
Back to skill

Security audit

虾皮A股选股器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed stock-screening helper that uses a DaxiAPI token for market data, with manageable credential-handling cautions.

Install only if you trust DaxiAPI and the `daxiapi-cli` npm package. Treat the DaxiAPI token as a paid-account credential: avoid pasting real tokens into chats, screenshots, or shell commands where history is retained, prefer a secure environment variable or protected config file, and rotate the token if it is exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation instructs users to set an API token directly via a CLI command but does not warn that the token is a sensitive credential that may be persisted in shell history, process lists, screenshots, or local CLI config storage. In a skill centered on financial data access, exposed tokens could allow unauthorized API use, quota exhaustion, or access under the user's account.

Static analysis

No suspicious patterns detected.