ClawHub
Back to skill

Security audit

Eastmoney Financial Data 1.0.2

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Eastmoney financial-data lookup skill that sends user queries and an API key to the documented Eastmoney API.

Install only if you intend to use Eastmoney's remote API. Keep EASTMONEY_APIKEY in a trusted environment, avoid echoing or logging it, and do not include confidential personal, account, or proprietary trading information in query text.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill performs privileged actions such as reading an environment variable and making outbound network requests, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a host may permit the skill under the assumption it is low-risk, while it can still access secrets and transmit user queries externally.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script sends both the user's query and the API key to a remote service, but it does not explicitly disclose this data transmission at runtime or obtain user acknowledgement. In a skill context, users may assume a local lookup, so undisclosed transmission of potentially sensitive financial queries can create privacy and trust risks even if the destination is the legitimate vendor API.

External Transmission

Medium
Category
Data Exfiltration
Content
"toolQuery": "东方财富最新价"
}

response = requests.post(url, headers=headers, json=data)
response.raise_for_status()
result = response.json()
print(result)
Confidence
87% confidence
Finding
requests.post(url, headers=headers, json=

External Transmission

Medium
Category
Data Exfiltration
Content
2. 使用POST请求调用接口：
   ```bash
   curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \
   --header 'Content-Type: application/json' \
   --header "apikey: $EASTMONEY_APIKEY" \
   --data '{"toolQuery":"用户的查询内容"}'
Confidence
88% confidence
Finding
curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/query' \ --header 'Content-Type: application/json' \ --header "apikey: $EASTMONEY_APIKEY" \ --data

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.