T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/astock_query.py:13- Finding
Predictable User-Controlled Import Path Enables Dependency Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Astock Data
Security checks for vulnerabilities and agentic risk
Overview
This stock-data skill mostly matches its stated purpose, but it handles API credentials and dependency loading in ways that deserve careful review before installation.
Install only if you are comfortable sending requested A-share symbols and your configured QGDATA_TOKEN to qgdata/QuantGo. Prefer setting QGDATA_TOKEN in the session environment instead of storing it in ~/.openclaw/.env, review or pin the qgdata dependency yourself, and be aware that the built-in trial token is shared and may fail or expose usage under a shared identity.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: pandas== --hash=sha256: ``` 4. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Explicitly document and enforce the expected package index rather than relying on ambient `pip` configuration. 6. Review package provenance, publisher identity, release history, and transitive dependencies before publishing updates. 7. Use automated dependency vulnerability and integrity scanning in the release process. 8. Install dependencies inside a dedicated, least-privileged virtual environment. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/astock_query.py:49- Finding
Shared API Credential Is Hardcoded in the Skill Source
- Content
View full analysis
bool: """Check whether the free trial token is being used""" return token == "Mj9mN2xP5qR8vL3tY7wZ1aB4cD6eF8gH9nX4pL2qR7sT5vY8wZ1aB3cD3Tgd7ffg" ``` ### Technical Analysis The source contains a reusable API token available to every person who can obtain the Skill package. Although the documentation intentionally describes it as a shared trial token rather than a private user secret, embedding it in source eliminates meaningful confidentiality and complicates rotation, revocation, attribution, and per-user abuse controls. The token-like value is passed to the external `qgdata` client. It is not decoded or executed as a payload. The risk is unauthorized service consumption and operational abuse rather than hidden local code execution. ### Attack Path 1. An attacker downloads or inspects the publicly distributed Skill. 2. The attacker extracts the embedded token from `astock_query.py`. 3. The attacker uses the token independently of the Skill to submit API requests. 4. The shared quota is consumed or the credential is used in a manner that triggers provider-side restrictions. 5. Legitimate users receive quota, rate-limit, or authorization failures. ### Impact Assessment Exploitation can consume the shared trial allowance, disrupt availability for all Skill users, and potentially cause the provider to suspend or revoke the credential. The shared token does n ...[truncated 158 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description materially misrepresents behavior by advertising unlimited, high-performance data access while also documenting a built-in shared token, local token loading, and upgrade/promotion flows. This is dangerous because users may unknowingly rely on undeclared external credential use and local resource access, reducing informed consent and increasing the chance of secret leakage or misuse of a shared credential.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
export QGDATA_TOKEN="your_personal_token_here"
或.env文件
echo "QGDATA_TOKEN=your_personal_token_here" >> ~/.openclaw/.env
text #### 📊 免费额度说明
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python export QGDATA_TOKEN="your_personal_token_here" # 或.env文件 echo "QGDATA_TOKEN=your_personal_token_here" >> ~/.openclaw/.env ``` #### 📊 免费额度说明
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The code explicitly opens and parses ~/.openclaw/.env to retrieve a token, which is direct access to a user credential store. In the context of a market-data query skill, this is more dangerous because the functionality does not require broad secret-file access, and such patterns normalize secret harvesting from user home directories.
- Content
python return token.strip() # 从.env文件获取（用户自定义token） env_path = os.path.expanduser("~/.openclaw/.env") if os.path.exists(env_path): try: with open(env_path, 'r', encoding='utf-8') as f:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "config_commands": [ "export QGDATA_TOKEN='您的API密钥'", "# 或添加到 ~/.openclaw/.env 文件", "echo 'QGDATA_TOKEN=您的API密钥' >> ~/.openclaw/.env" ], "benefits": [ "🔓 无限制API调用（告别每日1000次限制）",
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language content of the skill, including its description and all usage instructions, is entirely in Chinese. Under the language/locale policy, forcing a specific language without user opt-in is a policy issue unless the locale constraint is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill omits a privacy warning even though it sends user-requested stock queries and API credentials to an external provider. This is risky because users may provide sensitive symbols, strategies, or personal API tokens without understanding that those inputs are transmitted off-platform to a third party.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads credentials from both the environment and a user-scoped ~/.openclaw/.env file, which expands its privilege beyond a narrowly scoped market-data query tool. Accessing user credential stores increases the blast radius if the skill is repurposed, compromised, or simply used in an environment where the operator did not expect file-based secret harvesting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script contains a hardcoded fallback API token and will silently use it for network requests if no user token is present. Hardcoded shared credentials are dangerous because they can be abused by anyone with access to the code, can be revoked unpredictably, and may cause users to transmit requests under an unknown shared identity without informed consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The upgrade guide embeds marketing, pricing, registration URLs, and instructions to store API keys, which are outside the core function of returning stock data. This creates a capability mismatch where a data skill also acts as a promotional funnel, potentially steering users to disclose credentials or follow external links not necessary for the requested task.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "pro": "¥299/月 - 50万次调用", "enterprise": "¥999/月 - 不限次数" }, "register_url": "https://data.quantgo.ai/register", "docs_url": "https://data.quantgo.ai/docs" } }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "pro": "¥299/月 - 50万次调用", "enterprise": "¥999/月 - 不限次数" }, "register_url": "https://data.quantgo.ai/register", "docs_url": "https://data.quantgo.ai/docs" } }
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
On quota failures, the code returns upsell messaging promising expanded or 'unlimited' use rather than a minimal operational error. This is risky because it turns normal failure handling into account-conversion behavior, encouraging users to visit external sites and configure secrets when the manifest suggests only data-query behavior.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The top-level documentation says this is a professional A-share minute-data query script. Later code adds a dedicated test mode for quota exhaustion and constructs detailed commercialization/upgrade responses, which is an intent-level divergence from the module's stated role as a query tool.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script description and all user-facing messages are written in Chinese, and there is no indication that the user can choose another language or that the tool is intentionally restricted to a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language without opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.