ClawHub
Back to skill

Security audit

Stock Analysis Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a stock-analysis tool that uses third-party market and news services as advertised, with some setup, privacy, dependency, and reliability risks users should understand.

Install this only in a virtual environment with normal user privileges, review and preferably pin the Python dependencies, and provide only the API keys you intend the skill to use. Be aware that stock symbols, watchlists, and news-search queries may be sent to Yahoo Finance, AkShare, efinance, Alpha Vantage, Tushare, and Tavily depending on configuration. Avoid very large stock lists because the current code has no clear per-run request limit.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Resolution

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

text
requests>=2.28.0
yfinance>=0.2.0
akshare>=1.0.0
tushare>=1.2.0
efinance>=0.3.0
alpha-vantage>=3.0.0
python-dotenv>=1.0.0

The documented installation process in SKILL.md:82-87 is:

bash
cd ~/.openclaw/workspace/skills/stock_analysis_skill

# Install dependencies
pip3 install -r requirements.txt

Technical Analysis

All dependencies use inclusive minimum-version constraints without maximum versions, exact pins, hashes, or a lock file. Consequently, installation resolves whichever compatible releases are available at that time rather than a reproducible set of reviewed artifacts.

Python packages and their transitive dependencies can execute package-controlled code during installation and later when imported. This is especially relevant here because the dependencies implement network-facing market-data functionality and run while API credentials are available in the process environment.

There is no evidence that the currently named packages are malicious. The vulnerability is the absence of controls preventing a future compromised, malicious, or unexpectedly incompatible release from being installed automatically.

Attack Path

  1. An attacker compromises the release process or maintainer account of an allowed direct or transitive dependency.
  2. The attacker publishes a version satisfying the broad minimum-version constraint.
  3. A user follows the documented pip3 install -r requirements.txt procedure.
  4. Pip resolves and installs the compromised release because no exact version or integrity hash is enforced.
  5. Malicious installation or import-time code executes with the privileges of the user running the Skill.
  6. The compromised package may access files, network resources, and environment v ...[truncated 648 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version.
  2. Generate a fully resolved lock file that also pins transitive dependencies.
  3. Record package hashes and require integrity verification during installation:
    bash
    pip install --require-hashes -r requirements.txt
  4. Generate locked requirements using a controlled process such as pip-compile --generate-hashes.
  5. Review dependency updates before regenerating the lock file.
  6. Run vulnerability and provenance checks in CI, such as pip-audit, and monitor security advisories.
  7. Install and run the Skill in a non-administrative virtual environment with access only to necessary files and credentials.
  8. Avoid exposing all API credentials to components that do not require them.

T09 · Insecure Skill Coding Practices

Warning
Location
src/utils/helpers.py:16
Finding

Unbounded Stock Input Can Exhaust External API Quotas and Runtime Resources

Content
View full analysis

Vulnerability Details

File Locations: src/utils/helpers.py:16, src/analyzer.py:160-170
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

src/utils/helpers.py:16 accepts every nonempty comma-separated value without validation, deduplication, or a count limit:

python
return [code.strip() for code in stock_string.split(',') if code.strip()]

src/analyzer.py:160-170 then processes every supplied entry:

python
results = []

for code in codes:
    try:
        result = self.analyze_stock(code)
        results.append(result)
    except Exception as e:
        results.append({
            'code': code,
            'error': str(e),
        })

Each call to analyze_stock can perform quote retrieval, historical-data retrieval, fallback-provider requests, and an optional Tavily news search.

Technical Analysis

The input parser imposes no maximum input length, symbol count, or market-specific syntax requirements. Duplicate symbols are retained, allowing identical external requests to be repeated. The processing loop also has no per-invocation request budget, overall deadline, or rate limit.

A single stock entry may result in several outbound requests. For US or Hong Kong symbols, the Skill requests quote and historical data from Yahoo Finance and can invoke Alpha Vantage as a fallback. If news sentiment is enabled, it also sends a Tavily request for every entry. A large or duplicate-heavy list therefore amplifies a small input operation into many sequential network calls.

Although individual Tavily requests have a 30-second timeout, no overall execution timeout limits the complete batch.

Attack Path

  1. An attacker or untrusted caller supplies a very large comma-separated stock list, potentially containing thousands of duplicate or malformed values.
  2. parse_stock_codes accepts all nonempty entries without enforcin ...[truncated 999 chars]
Remediation
View remediation

Remediation Suggestions

  1. Enforce a conservative maximum number of symbols per invocation, such as 20 or another documented operational limit.
  2. Reject oversized raw input before splitting it.
  3. Normalize and deduplicate symbols before analysis.
  4. Validate symbols using market-specific allowlists:
    • A-shares: expected numeric length and supported exchange prefixes.
    • Hong Kong: explicit hk prefix followed by the expected number of digits.
    • US stocks: a restricted set of supported uppercase ticker characters and lengths.
  5. Add a per-invocation external-request budget and stop processing once it is reached.
  6. Apply provider-specific rate limits and quota accounting.
  7. Cache recent results to avoid repeated requests for duplicate symbols.
  8. Add an overall batch deadline rather than relying solely on individual request timeouts.
  9. Return a clear validation error when input exceeds configured limits.
  10. Restrict access to the analysis entry point if it is exposed through a shared or remotely accessible Agent interface.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (34)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 341)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 344)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 345)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

Configuration

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 342)May include surrounding context.

bash
# Copy example .env file
cp .env.example .env

# Edit .env and add your API keys
nano .env

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The AlphaVantageDataSource class is internally inconsistent: later method redefinitions replace the earlier Alpha Vantage implementation with efinance and then Tushare logic while keeping the class name and surrounding documentation unchanged. In Python, the last definition wins, so callers expecting a US-stock Alpha Vantage backend may silently execute unrelated code paths, leading to incorrect provider use, broken authorization assumptions, data integrity failures, and accidental access to attributes that were never initialized for this class.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The README presents the output format and much of the duplicated second-half documentation in Chinese, but does not state that language is optional or user-selectable. This can indicate a locale/language bias in the skill experience without explicit user opt-in, which falls under the language policy check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises third-party integrations for quotes and news sentiment, but the documentation does not clearly warn that user-provided stock symbols, watchlists, and related queries may be sent to external providers such as Yahoo Finance, Alpha Vantage, Tavily, or other market-data backends. This creates a privacy and data-handling risk because portfolio interests and trading research may be sensitive, and users may unknowingly disclose them to third parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill returns user-facing action labels in Chinese ('买入', '卖出', '观望') and also builds reasoning text in Chinese elsewhere, with no indication that the user can choose their preferred language or locale. This creates a natural-language policy concern if the organization requires user opt-in before forcing a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reasoning string and default fallback message include hardcoded Chinese text such as '技术趋势', '涨跌幅', '舆情', and '数据不足'. Because the file does not offer language selection or document a justified region-specific constraint, this appears to force a specific locale on all users.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/analysis/sentiment.py (reported line 50)May include surrounding context.

python
search_query = f"{stock_code} stock news analysis {days} days"
        
        url = "https://api.tavily.com/search"
        headers = {
            'Content-Type': 'application/json',
            'Authorization': f'Bearer {self.api_key}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/analysis/sentiment.py (reported line 63)May include surrounding context.

python
'include_raw_content': False
        }
        
        response = requests.post(url, json=data, headers=headers, timeout=30)
        response.raise_for_status()
        
        results = response.json()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The formatted report strings, including headings, field labels, and disclaimer, are all hard-coded in Chinese. This imposes a specific language on all users without any visible option to choose locale or opt in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown includes a full report example in Chinese and later duplicates substantial documentation in Chinese, but does not state that output language is user-selectable. This can create a locale-policy concern if the skill defaults to a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency is specified with a lower bound only, which permits installation of any newer release and makes builds non-reproducible. This increases supply-chain risk because a future vulnerable or malicious release could be pulled in without review, and it also prevents verifying whether known advisories affect the deployed version.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0
yfinance>=0.2.0
akshare>=1.0.0
tushare>=1.2.0

Static analysis

No suspicious patterns detected.