T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:42- Finding
Mandatory preflight command exposes the Tushare API token
- Content
View full analysis
- Remediation
View remediation
Security audit
Financial Event Historical Impact Analyzer
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real financial-analysis skill, but its setup instructions can expose an API token and encourage privileged system package installation.
Review before installing. Use it only if you are comfortable sending financial data requests to Yahoo Finance, Tushare, and optionally FRED, and writing reports under the OpenClaw workspace. Do not run echo $TUSHARE_TOKEN or store tokens directly in ~/.bashrc; use a protected secret mechanism or a presence-only environment check. Avoid sudo font installation unless you intentionally administer the host environment, and prefer an isolated virtual environment with locked dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:47- Finding
Third-party dependencies are installed without reproducible integrity constraints
- Content
View full analysis
=1.5.0", "numpy>=1.20.0", "matplotlib>=3.5.0", "yfinance>=0.2.0", "tushare>=1.2.0" ] ``` ### Technical Analysis The installation command accepts whatever package versions and transitive dependencies are current when installation occurs. The metadata similarly uses open-ended minimum-version constraints. The project provides no lock file, exact versions, package hashes, or trusted-index enforcement. Consequently, the dependency set executed by future users can differ from the dependency set present when the Skill was reviewed. Python packages may execute code during installation or later during import. A compromised package release, compromised transitive dependency, or maliciously configured package index could therefore introduce code that is not visible in this repository. The package names observed in the project are consistent with the declared financial-analysis libraries. The audit found no evidence of typosquatting, an intentionally malicious package, or an untrusted download URL. This finding concerns the mutable and unverified supply chain rather than a confirmed malicious dependency. ### Attack Path 1. A user or agent follows the documented `pip install` command. 2. pip resolves the latest compatible direct and transitive dependencies from its configured index. 3. An upstream package release, transitive dependency, or configured package index has been compromised. 4. The compromised component is selected because no exact version or hash is enforced. 5. Malicious code executes during installation or when one of the Skill scripts imports the package. 6. That code runs with the per ...[truncated 890 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description says the skill analyzes financial events and their effects on assets, similar to Kensho-style event studies, and outputs Chinese reports and charts. The supplied code does not perform analysis of events, reactions, precedents, or causality. It only retrieves historical indicator data for a fixed mapping of symbols from external providers and emits tabular/raw output. This is a materially different primary purpose: data collection rather than event-impact analysis. Additionally, the code accesses external services (Yahoo Finance, FRED, Tushare), which is not reflected in the declared permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 83% confidence
- Finding
The declared description emphasizes event-driven financial analysis: assessing how assets reacted to identifiable events such as oil surges, gold rises, or rate hikes, with historical precedent and causal relationship analysis, plus Chinese reports and charts. The supplied code instead performs technical pattern detection on a single price series: it computes rolling percentage changes and volatility, classifies the current move, and finds historically similar periods by thresholded price change and direction. There is no logic for ingesting or identifying external events, no linkage between an event and related assets, no causal analysis, and no chart or Chinese-report generation. While the notion of finding similar historical episodes is loosely related to historical precedent analysis, the primary behavior is materially narrower and different from the declared event-driven impact-analysis purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description emphasizes historical precedent analysis of how assets reacted to events, which implies data-driven event analysis over historical observations. This code instead maps an input indicator and direction to predefined asset lists using static dictionaries. It adds multi-economy summaries and lists indicators that could later be charted, but it does not fetch market data, perform historical backtesting, measure reactions, generate charts, or produce substantive reports beyond formatted console output. The code is related in topic—event-to-asset causal relationships—but its primary behavior is asset inference, not historical impact analysis. Therefore the description materially overstates and misrepresents the implemented capability.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **自动检查**: `generate_charts.py` 会自动执行前置检查，输出结果。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md **自动检查**: `generate_charts.py` 会自动执行前置检查，输出结果。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares sensitive environment variables and instructs file reads/writes, but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this can lead to overbroad execution authority, making it easier for the skill to access secrets or modify files beyond what is necessary for financial analysis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description states 'Outputs Chinese reports and charts,' which imposes a specific language as part of the skill behavior. This is a natural-language policy concern because the file does not indicate any user choice, opt-in, or justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The overview explicitly defines the output as '中文分析报告 + 中文标注图表,' making Chinese mandatory. Because no opt-in or alternative language path is provided, this constitutes a locale policy violation under the stated rules.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The skill documentation instructs use of sudo for installing fonts as part of normal execution preparation. In agent or sandboxed environments, normalizing privileged commands is dangerous because users or orchestration systems may run elevated package-management actions unnecessarily, increasing host compromise risk if dependencies or commands are altered or if the environment is shared.
- Content
md | 检查项 | 命令 | 失败修复 | |--------|------|---------| | **中文字体** | `fc-list :lang=zh family` | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` | | **TUSHARE_TOKEN** | `echo $TUSHARE_TOKEN` | 在 ~/.bashrc 中设置 | | **输出目录** | `mkdir -p memory/reports/` | 确保有写权限 |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Embedding OS-specific sudo install commands in the skill encourages privilege escalation to satisfy optional presentation dependencies. In the context of an agent skill that handles API tokens and writes files, this broadens operational risk by mixing data-processing tasks with system-level package installation guidance.
- Content
md | 系统 | 安装命令 | |------|---------| | **Ubuntu/Debian** | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` | | **CentOS/RHEL** | `sudo yum install wqy-microhei-fonts` | | **macOS** | 系统自带 PingFang SC / Heiti SC | | **Windows** | 系统自带 SimHei（黑体） |
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The yum-based sudo instruction has the same issue: it encourages elevated execution for a nonessential dependency. In a security-sensitive agent ecosystem, any skill that normalizes root actions becomes more dangerous because it can condition operators to run privileged commands in response to skill prompts.
- Content
md | 系统 | 安装命令 | |------|---------| | **Ubuntu/Debian** | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` | | **CentOS/RHEL** | `sudo yum install wqy-microhei-fonts` | | **macOS** | 系统自带 PingFang SC / Heiti SC | | **Windows** | 系统自带 SimHei（黑体） |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The report requirements section specifies '语言: 中文' as a mandatory constraint. This is a natural-language policy issue because it forces a specific language without documenting user choice or a necessary region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction '输出时使用中文' forces a specific language for the skill output. Under the stated policy, language constraints should either be optional for the user or clearly justified as region-specific; this template provides neither.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code presents command-line descriptions and help messages only in Chinese, while other parts of the file are in English. That creates a language-policy issue because the skill effectively forces one locale for operation guidance without opt-in or alternative language support.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring states that charts are created with Chinese labels, and the implementation consistently configures Chinese fonts and Chinese output text. Because this code file hard-codes a specific language/locale for user-facing output without any opt-in or alternative, it violates the natural-language locale policy criteria.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python return True, cjk_fonts[0], f"✓ 找到备选CJK字体: {cjk_fonts[0]}" # 无中文字体 return False, FALLBACK_FONT, f"❌ 未找到中文字体，图表将显示方框。请安装: sudo apt install fonts-wqy-microhei fonts-noto-cjk" def setup_chinese_font() -> str:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a general-purpose skill for analyzing historical impact of financial events on related assets, but the script docstring explicitly states it generates charts for Fed balance-sheet reduction cycles only. The code reinforces this specialization by labeling all events as '缩表周期', fixing chart titles to QT-specific language, and generating only a preset set of Treasury/asset comparison charts, which is materially narrower than the claimed broad event-driven analysis capability.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings and naming mappings that force report content into Chinese, including indicator names, comments, table headers, and output formatting. Under the policy, a skill should not impose a specific language or locale without user opt-in unless the constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file includes natural-language comments and runtime output in Chinese, such as the printed analysis headings and reasons later in the script, while the CLI provides no option for users to select language or locale. That creates a language/locale policy concern because the skill appears to impose a specific language experience by default rather than offering opt-in or clearly limiting itself to a Chinese-only context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
infer_related_assets()returns benefited, harmed, and neutral data but omitsmacro_indicators, even though downstream helpers and the skill description imply macro indicators are part of the analysis output. In this financial-analysis skill, that omission can silently produce incomplete reports or decisions based on missing cross-economy macro signals, which is an integrity problem rather than code-execution risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description states that the skill outputs Chinese reports and Chinese-labeled charts, imposing a specific language choice by default. This is a natural-language locale policy issue because the manifest does not indicate user choice, opt-in, or a documented region-specific justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest trigger list includes broad phrases like "event-driven analysis" and "historical impact analysis," which are generic analytical terms rather than narrowly scoped invocations for this specific financial skill. Because this is a manifest file, such vague triggers could cause unintended activation outside the intended finance-event context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple chart specification sections explicitly set the language to "Chinese," which hard-codes a locale choice in the skill configuration. Without user opt-in or a documented regional justification, this conflicts with the language/locale policy requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file switches from English to substantial Chinese-only section headers, table values, and explanatory text, which can impose a language/locale requirement on users without opt-in. The policy for natural-language violations applies to all file types, and there is no note explaining that the document is intentionally China- or Chinese-language-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language docstrings and console output only in Chinese, including the module description and all printed status messages. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content