T09 · Insecure Skill Coding Practices
Warning
- Location
test-alpha.js:9- Finding
Hardcoded Alpha Vantage API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Yahoo Claw
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its finance-data purpose, but it needs review because it ships a hardcoded Alpha Vantage API key and has weak input controls around outbound market-data requests.
Review before installing. Rotate or remove the embedded Alpha Vantage key, prefer environment-provided credentials only, validate and encode ticker/indicator parameters, set batch and news limits, and present technical/sentiment outputs as informational rather than investment advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/api/AlphaVantage.js:30- Finding
Query-Parameter Injection in Alpha Vantage Requests
- Content
View full analysis
`&${key}=${value}`) .join(''); } ``` ### Technical Analysis Caller-controlled symbols, indicator names, parameter names, and parameter values are inserted into a URL without validation or percent encoding. Delimiter characters such as `&` and `=` can therefore introduce additional query parameters. For example, an attacker-controlled symbol resembling `AAPL&function=OTHER_FUNCTION` changes the set of query parameters received by Alpha Vantage. The `params` object is especially sensitive because it is appended after the legitimate `apikey` parameter and permits arbitrary parameter names. The effect of duplicate parameter names depends on Alpha Vantage's server-side parser, s ...[truncated 1370 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
src/modules/Quote.js:58- Finding
Unbounded Concurrent Quote Requests
- Content
View full analysis
this.getQuote(symbol)) ); return { success: true, data: results.filter(r => r.success).map(r => r.data), failed: results.filter(r => !r.success).map(r => ({ symbol: symbols[results.indexOf(r)], error: r.error })), message: `Successfully retrieved ${results.filter(r => r.success).length}/${symbols.length} stock records` }; } ``` ### Technical Analysis `getQuotes()` accepts an arbitrary value as `symbols`, does not verify that it is a bounded array of valid ticker strings, and starts every request concurrently through `Promise.all()`. A sufficiently large array can cause a burst of outbound Yahoo Finance requests, retain a large number of promises and responses in memory, and consume provider rate limits. Because there is no concurrency pool, per-caller quota, or batch-size restriction, application availability depends on callers voluntarily providing small inputs. ### Attack Path 1. An attacker or untrusted integration invokes `getQuotes()` with a very large symbols array. 2. The method maps every entry to `getQuote()` without imposing a maximum size. 3. `Promise.all()` starts all generated operations concurrently. 4. The process experiences elevated socket, memory, CPU, and event-loop pressure. 5. Yahoo Finance rate limits may be consumed, degrading service for legitimate users. ### Impact Assessment No additional privileges are obtained. The impact is limited to availability and external-service quota usage within the process running the Skill. Potential consequences include: - Local resource exhaustion - Increased request latency - Process instability under constrained memory - Yahoo Finance throttling - Reduced av ...[truncated 44 chars]- Remediation
View remediation
50) { throw new TypeError('symbols must contain between 1 and 50 entries'); } const uniqueSymbols = [...new Set(symbols)]; const results = await runWithConcurrencyLimit(uniqueSymbols, 5, symbol => this.getQuote(symbol) ); ``` ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
src/modules/News.js:18- Finding
Unbounded News Result Limit
- Content
View full analysis
- Remediation
View remediation
50) { throw new RangeError('limit must be an integer between 1 and 50'); } const limit = requestedLimit; ``` Also: 1. Validate `sources` as a bounded array containing only supported source identifiers. 2. Apply request-rate limits outside the module. 3. Limit the maximum amount of remote text processed for sentiment analysis. 4. Add tests for negative, fractional, non-numeric, infinite, and extremely large values. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
src/api/APIManager.js:101- Finding
Request Timeout Does Not Cancel Underlying Network Operations
- Content
View full analysis
{ setTimeout(() => reject(new Error(`Request timeout (${ms}ms)`)), ms); }); } ``` ### Technical Analysis `Promise.race()` stops waiting when the timeout rejects, but it does not cancel `api[method](...args)`. The Yahoo Finance or Alpha Vantage request can continue running after the caller has received a timeout result. Repeated requests against a slow or unresponsive provider can therefore accumulate underlying network operations. Failover can also start another provider request while the timed-out request remains active, multiplying resource and quota consumption. ### Attack Path 1. An attacker repeatedly triggers quote or history requests while a provider is slow or responses are delayed. 2. Each manager call starts an API request and a timer. 3. The timer rejects first, but the API request remains active. 4. The manager continues to another fallback provider or returns failure. 5. Continued invocation accumulates background network work and consumes resources after nominal timeout handling. ### Impact Assessment No operating-system privileges are gained. The impact is constrained to service availability and provider quota use. Potential consequences include: - Accumulated sockets and pending promises - Continued API quota consumption after timeout - Duplicate work during fallback - Memory and event-loop pressure - Reduced availability under repeated invocation ]]>- Remediation
View remediation
controller.abort(), timeout); try { return await fetch(url, { signal: controller.signal }); } finally { clearTimeout(timeoutId); } ``` ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (41)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Recommended permissions
chmod 755 src/ chmod 644 src/*.js chmod 600 .env # If exists
text ### 5. Network Security
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Recommended permissions
chmod 755 src/ chmod 644 src/*.js chmod 600 .env # If exists
text ### 5. Network Security
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Undeclared news aggregation, sentiment analysis, telemetry, caching statistics, and technical indicator testing indicate a broader operational footprint than the skill description suggests. In this context, the finance domain does not make the mismatch harmless; instead it increases risk because users may rely on the skill for data provenance and narrowly scoped market-data access.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The manifest narrowly describes the skill as a Yahoo Finance API integration, but this file is explicitly an Alpha Vantage API module and all requests are sent to alphavantage.co. That is a semantic mismatch in provider behavior, not just an implementation detail, because the skill claims one external data source while actually using another.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly documents technical indicators that produce BUY/SELL-style recommendations with confidence scores, but it does not prominently warn users that these outputs are not financial advice and may be inaccurate or unsuitable for trading decisions. In an agent skill context, this increases the chance that users treat generated signals as authoritative, which can lead to harmful financial decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents sentiment analysis as bullish/bearish market signals and labels like POSITIVE, NEGATIVE, and BULLISH without a clear warning that sentiment models can be noisy, biased, or wrong. Because this is packaged as an OpenClaw skill for conversational use, users may over-trust these labels as actionable investment guidance rather than heuristic summaries.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
4. File Permissions
bash # Recommended permissions chmod 755 src/ chmod 644 src/*.js chmod 600 .env # If exists
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Recommended permissions chmod 755 src/ chmod 644 src/*.js chmod 600 .env # If exists
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Recommended permissions
chmod 755 src/ chmod 644 src/*.js chmod 600 .env # If exists
text ### 5. Network Security
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares network access and environment-variable usage in prose, but it does not define a formal tool scope such as explicit permissions or allowed-tools in the metadata. That creates an authorization gap where the runtime or reviewer cannot reliably enforce or verify what capabilities the skill should have, increasing the risk of unnoticed outbound requests or secret access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's docstring, comments, and console messages are entirely in Chinese, which imposes a specific language on users running the script. Under the policy, locale or language restrictions should either provide user opt-in or be clearly documented as region-specific and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation states that requests automatically fail over to Alpha Vantage and that successful responses are cached, but it does not clearly warn users that ticker queries and related market-request metadata may be transmitted to a third-party provider and stored locally or in memory. In a finance-related skill, query content can reveal user interests, trading research, or proprietary watchlists, so silent provider switching and caching can create privacy, compliance, and data-handling risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states that the system will automatically fail over to Alpha Vantage and that the user will be unaware of the switch, but it does not disclose that user requests and queried symbols may be sent to a different third-party provider. This creates a transparency and privacy issue because operators or end users may assume data stays with Yahoo Finance when in fact requests may be routed elsewhere under failure or rate-limit conditions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code includes natural-language documentation and runtime log/error strings in Chinese, which effectively imposes a specific language on users and maintainers. The file does not indicate that the skill is region-specific or provide any opt-in or localization mechanism, so it may violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and returned message strings exclusively in Chinese, such as the module description and success/error messages. Under the policy, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a Yahoo Finance integration for retrieving market data, but this file implements a separate Alpha Vantage provider and pulls credentials from process environment state. Accessing environment variables for third-party credentials is a broader capability than the stated user-facing purpose and is not implied by the manifest description alone.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The constructor sets
langtozh-CNby default, which imposes a specific language/locale choice when the caller does not explicitly provide one. This is a natural-language policy concern because the file does not indicate user opt-in or a documented region-specific justification for forcing Chinese as the default language.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Comments and the returned success message are written in Chinese, including the user-facing string at L061. The file does not indicate that the user can choose a language or that the locale restriction is intentional and justified, which can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The constructor sets
langtozh-CNby default, which imposes a specific language preference in the skill behavior. This is a natural-language/locale policy concern because the file does not show an explicit user choice, opt-in, or justification for forcing Chinese as the default locale.- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/api/AlphaVantage.js:8
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-alpha.js:10