ClawHub
Back to skill

Security audit

Stock Entry Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a stock-analysis tool, but some bundled executable scripts silently use a finance API credential and pass the full runtime environment to another skill.

Install only if you are comfortable with a stock-analysis skill that can run local scripts and depend on other finance-data skills. Review or remove the legacy scripts that read the EastMoney credential vault and pass the full environment to mx-finance-data, and treat all buy/sell outputs as informational rather than personal financial advice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/analyze_stocks.py:63
Finding

Excessive Credential Access and Unrestricted Environment Disclosure to an External Skill

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
84% confidence
Finding

The code forwards the full parent process environment into a child process while also injecting a sensitive API credential. In a skill-based execution environment, this broad inheritance can unnecessarily expose unrelated secrets, tokens, and runtime context to another script, increasing the blast radius if that downstream component is compromised, overly verbose, or logs its environment.

Content

Scanner excerpt · scripts/analyze_stocks.py (reported line 77)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
93% confidence
Finding

The child process inherits the full parent environment via os.environ while also injecting EM_API_KEY. In an agent or skill ecosystem, broad environment forwarding can expose unrelated secrets, tokens, proxies, and runtime credentials to helper scripts, significantly enlarging the blast radius if those scripts are compromised or behave unexpectedly.

Content

Scanner excerpt · scripts/analyze_stocks_v2.py (reported line 58)May include surrounding context.

python
capture_output=True,
            text=True,
            timeout=60,
            env={**os.environ, 'EM_API_KEY': em_api_key}
        )
        
        # 解析输出获取文件路径

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
88% confidence
Finding

The script reads a secret API key from environment variables or a credential file and then constructs a child-process environment by copying the entire process environment. In a skill ecosystem where downstream scripts may be less trusted, this unnecessarily exposes credentials and other environment secrets to external code, increasing the risk of secret leakage.

Content

Scanner excerpt · scripts/analyze_stocks_v3.py (reported line 112)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill explicitly harvests a secret from the runtime environment or a vault file and forwards it to another script. In a skill/plugin setting, this is dangerous because it normalizes credential access and propagation across components; if the downstream script is modified, compromised, or overly verbose in logging/errors, the secret can be exposed or abused for unauthorized API access.

Content

Scanner excerpt · scripts/analyze_stocks_v3_detailed.py (reported line 87)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description, trigger phrases, examples, and output templates are consistently presented only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can violate a language/locale policy requiring user choice or explicit justification for locale constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad enough to activate on ordinary investment conversation, which can cause the skill to run unexpectedly and present authoritative-seeming financial recommendations when the user may not have explicitly requested this workflow. In an agent setting, overbroad activation increases the chance of unintended tool use, excessive data access, and misleading automated advice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description and threshold section state that the preferred BIAS entry range is 5%-15% and mark 2.14% as below that documented target. However, this example checklist and recommendation instead evaluate against a much narrower 0.6%-1.8% interval, creating a direct contradiction in the skill's own documentation about what counts as a valid entry signal.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document provides specific trading thresholds and entry/exit rules that could be interpreted as actionable financial advice, yet it does not include any warning about investment risk, uncertainty, suitability, or the possibility of loss. In the context of an agent skill, users may over-trust this structured guidance and act on it as prescriptive advice, which increases the chance of financial harm from losses or inappropriate trading decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file is entirely written as a prescriptive scoring/output reference in Chinese, including the required output template, with no indication that users may choose another language. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module title and descriptive text are written entirely in Chinese, and the generated user-facing report strings throughout the file are also Chinese-only. This imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific for compliance or audience reasons.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks.py (reported line 41)May include surrounding context.

python
query_str = ",".join(codes)
    
    try:
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/stock-price-query/scripts/stock_query.py', query_str],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v3_detailed.py (reported line 51)May include surrounding context.

python
query_str = ",".join(codes)
    
    try:
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/stock-price-query/scripts/stock_query.py', query_str],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks.py (reported line 78)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v3.py (reported line 113)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v3_detailed.py (reported line 88)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],
            capture_output=True,

Tainted flow: 'env' from os.environ.get (line 77, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/analyze_stocks.py (reported line 78)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code.replace(".HK", "")}.HK EMA 均线'],
            capture_output=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring at L117-L122 states this function calculates a real EMA20 from historical K-line data, with fallback estimation. However, the implementation at L131-L146 does not retrieve historical series at all; it invokes the live quote script again and derives EMA20 from current price plus a guessed 20-day change extrapolated from 5-day change. This is an active contradiction between documentation and behavior, not merely missing detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads an API credential from a fixed sensitive file path without any explicit user-facing disclosure or consent. In an agent-skill context, silent credential access is dangerous because it can expand the skill's privileges beyond what a user expects and normalize undisclosed secret consumption.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v2.py (reported line 53)May include surrounding context.

python
try:
        # 调用妙想数据脚本
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py', '--query', query],
            capture_output=True,
            text=True,

Tainted flow: 'em_api_key' from os.environ.get (line 33, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/analyze_stocks_v2.py (reported line 53)May include surrounding context.

python
try:
        # 调用妙想数据脚本
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py', '--query', query],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v2.py (reported line 111)May include surrounding context.

python
codes = [s['code'].replace('.HK', '').replace('.SZ', '').replace('.SH', '') for s in STOCKS]
    
    try:
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/stock-price-query/scripts/stock_query.py', ','.join(codes)],
            capture_output=True,
            text=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The report states that the data source is the Eastmoney/Miaoxiang service even though the code can silently fall back to Tencent data. This can mislead users about provenance and trustworthiness of financial analysis, undermining auditability and causing decisions based on inaccurate assumptions about source quality and consistency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring and all user-facing report content are written in Chinese, indicating the skill is designed to operate in a fixed language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v3.py (reported line 75)May include surrounding context.

python
query_str = ",".join(batch)
        
        try:
            result = subprocess.run(
                ['python3', '/root/.openclaw/workspace/skills/stock-price-query/scripts/stock_query.py', query_str],
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_stocks_v4.py (reported line 228)May include surrounding context.

python
query_str = ",".join(batch)
        
        try:
            result = subprocess.run(
                ['python3', '/root/.openclaw/workspace/skills/stock-price-query/scripts/stock_query.py', query_str],
                capture_output=True,
                text=True,