ClawHub
Back to skill

Security audit

YahooClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Yahoo Finance market-data helper with some overstated documentation and financial-advice wording, but I did not find hidden, destructive, persistent, or credential-stealing behavior.

Before installing, treat this as a third-party finance-data package that will send queried symbols to Yahoo Finance and may return delayed or inaccurate data. Do not rely on its buy/sell recommendations as financial advice, and consider pinning dependencies if using it in a controlled environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

getNews('MSFT', { limit: 5, sentiment: true }); console.log(msft.data.overallSentiment);

text

### 4. Use via OpenClaw Conversation

User: Query Apple stock price PocketAI: Sure, querying AAPL... Apple Inc. (AAPL) current price: $260.83 Change: +$0.95 (+0.37%) 📈 Market Cap: $2.73T

text

---

## 📚 API Documentation

### getQuote(symbol)

Get real-time stock quote

**Parameters:**
- `symbol` (string): Stock code, e.g., 'AAPL', 'TSLA', '0700.HK'

**Returns:**
```javascript
{
  success: true,
  data: {
    symbol: 'AAPL',
    name: 'Apple Inc.',
    price: 175.43,
    change: 2.15,
    changePercent: 1.24,
    previousClose: 173.28,
    open: 173.50,
    dayHigh: 176.00,
    dayLow: 173.00,
    volume: 52000000,
    marketCap: 2730000000000,
    pe: 28.5,
    eps: 6.15,
    dividend: 0.96,
    yield: 0.0055,
    currency: 'USD',
    exchange: 'NMS',
    marketState: 'REGULAR',
    timestamp: '2026-03-10T12:00:00.000Z'
  },
  message: 'Successfully retrieved

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents this skill as a broad Yahoo Finance market-data integration focused on quotes, financials, historical data, dividends, and related analysis. However, the supplied code chunk is specifically a news module: it calls yahooFinance.search(..., { newsCount }) to retrieve news items, sorts and limits articles, and computes sentiment labels/statistics using keyword matching. That is materially different from the declared primary purpose because the implemented functionality is centered on news and sentiment analysis, while the advertised capabilities around stock prices, company financials, historical data, dividends, and real-time quotes are not present in this code. Although 'market analysis' could loosely overlap with sentiment output, the core behavior still does not accurately match the description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied code is clearly related to Yahoo Finance and stock market data, so the general domain matches the description. However, this specific code chunk only provides real-time quote lookup and batch quote aggregation. It does not implement historical data access, financial statement retrieval, or market analysis features that are explicitly claimed in the declared purpose. There is no evidence of undeclared dangerous behavior or inconsistent resource access; the mismatch is that the description materially overstates the implemented capabilities of this chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is a strong description/behavior mismatch. The declared purpose centers on Yahoo Finance API integration and market-data retrieval capabilities. The supplied code contains no networking, authentication, request handling, or Yahoo-specific logic. Instead, it operates purely on input arrays of highs/lows/closes to compute technical indicators and synthesize buy/sell recommendations. While 'market analysis' is mentioned in the description, the primary advertised functionality is an external finance API integration, which this code does not implement. Therefore the code's actual purpose is materially different from the declared one.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description broadly fits a finance/market-data skill, and some tested behaviors align with it, such as stock quotes and historical data. However, the supplied code chunk is not the integration itself; it is a comprehensive test file. It validates additional capabilities beyond the declared description, including technical indicators, news sentiment aggregation, caching/failover behavior, and API usage statistics. These are materially different or undeclared capabilities relative to the stated purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README presents explicit trading signals such as BUY, STRONG_BUY, SELL, confidence scores, and recommendation text without any clear disclaimer that the output is not financial advice. In a finance-focused skill, this can materially influence user behavior and create decision-making harm, especially because the presentation makes the signals appear authoritative and production-ready.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README advertises news aggregation and backup API features but does not disclose that user-requested stock symbols, timing, and related metadata will be sent to external providers such as Yahoo Finance and Alpha Vantage. In an agent-skill context, this can create an unexpected data exposure path, especially when users assume queries are handled locally or when symbols/watchlists are sensitive business intelligence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill uses Chinese for its functional description, usage scenarios, parameter explanations, and troubleshooting content, which imposes a specific language on users. The policy requires avoiding forced language/locale constraints unless the skill offers a choice or clearly justifies the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The constructor assigns lang to zh-CN by default, which imposes a specific language/locale choice unless the caller explicitly overrides it. The policy for this category flags language or locale constraints when they are forced without documented user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s comments and returned user-facing status/error messages are written exclusively in Chinese, including success and failure strings returned by the API. This enforces a specific language/locale without any visible opt-in, fallback, or configuration mechanism, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The API returns natural-language messages such as success and failure notices only in Chinese. Because there is no visible user choice or configuration for language, the module appears to mandate a single locale for all consumers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file uses Chinese-only natural-language strings for its module description and user-facing success message, which imposes a specific language without any opt-in or indication that the skill is intentionally region-specific. This matches the policy category for language or locale constraints lacking user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The constructor defaults lang to zh-CN, which imposes a specific language/locale choice when the caller does not explicitly provide one. The policy allows locale constraints only when the user is given a choice or the constraint is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JavaScript file contains natural-language documentation and user-facing recommendation strings exclusively in Chinese, including the module description and investment advice text. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the file clearly documents a justified region-specific constraint, which it does not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This JavaScript file contains comments and console output exclusively in Chinese, including status, error, and usage guidance. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes the skill as a Yahoo Finance integration for stock prices, financials, historical data, dividends, and market data, plus market analysis. This test file shows a getNews capability with sentiment aggregation and sentiment statistics, which is a materially broader feature than the stated manifest scope and not an obvious implementation detail of quote/financial-data retrieval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

SQP-3 covers natural-language policy issues in all file types, including locale constraints. Although an English documentation link is present, this file itself provides the skill guidance entirely in Chinese and does not state that language selection is user-driven or that the locale is intentionally region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"url": "https://github.com/leohuang8688/yahooclaw.git"
  },
  "dependencies": {
    "dotenv": "^17.3.1",
    "yahoo-finance2": "^2.11.3"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
},
  "dependencies": {
    "dotenv": "^17.3.1",
    "yahoo-finance2": "^2.11.3"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"yahoo-finance2": "^2.11.3"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "eslint": "^8.55.0",
    "jest": "^29.7.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.10.0",
    "eslint": "^8.55.0",
    "jest": "^29.7.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 34)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.10.0",
    "eslint": "^8.55.0",
    "jest": "^29.7.0"
  },
  "engines": {
    "node": ">=20.0.0"

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

The manifest emphasizes stock prices, company financials, historical data, dividends, and market data, with a general mention of market analysis. This file validates a dedicated getTechnicalIndicators feature producing MA/RSI/MACD indicators and trading signals, which is more specific analytical functionality than the manifest clearly declares.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.