ClawHub
Back to skill

Security audit

Stock Price Query MX

Security checks for vulnerabilities and agentic risk

Overview

This stock-quote skill mostly matches its purpose, but its Hong Kong stock path silently uses a local credential vault and runs another skill with broad environment access.

Review before installing. A and US quote lookups use a normal external market-data endpoint, but HK quote lookups can read an Eastmoney API key from a shared local vault and run another installed skill with broad environment access. Install only if you trust the publisher, the mx-finance-data skill, and the host environment, and prefer a revised version that discloses and scopes credentials and dependencies.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/stock_query.py:143
Finding

Undisclosed Access to a Shared Credential Vault

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/stock_query.py:155
Finding

Full Environment and API Credential Passed to an Unreviewed External Skill

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/stock_query.py:175
Finding

Unvalidated File Paths from an External Process Are Opened by an Excel Parser

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Security-Relevant Dependencies and Credential Requirements Are Not Declared

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A second description-versus-behavior mismatch reinforces that the skill omits mention of credential/file-system access and external helper execution while asserting no API key is needed. In security review terms, hidden secret consumption and undeclared cross-skill/script dependencies materially increase supply-chain and data-access risk because operators may approve a tool under false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A second description-versus-behavior mismatch reinforces that the skill omits mention of credential/file-system access and external helper execution while asserting no API key is needed. In security review terms, hidden secret consumption and undeclared cross-skill/script dependencies materially increase supply-chain and data-access risk because operators may approve a tool under false assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states a no-key, Tencent-based strategy, but the implemented HK path actually uses an Eastmoney helper plus credential lookup. This discrepancy hides privileged behavior from users and reviewers, making the skill more dangerous because its real access pattern is broader than advertised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises that it requires no API key, but the Hong Kong stock path conditionally retrieves one from environment variables or a local vault file. That mismatch is security-relevant because it causes hidden credential use and undermines user expectations about what resources the skill will access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script reads a secret from a fixed vault path unrelated to a simple no-key quote lookup interface. Accessing local credentials expands the skill’s authority and creates unnecessary exposure of sensitive material if the script, helper, logs, or surrounding environment are compromised.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

The script forwards the entire parent environment to a child process while also injecting EM_API_KEY. In an agent environment, inherited environment variables often contain unrelated secrets or tokens, so this unnecessarily broad propagation can expose sensitive data to the helper script and any of its transitive dependencies.

Content

Scanner excerpt · scripts/stock_query.py (reported line 157)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
96% confidence
Finding

The pattern copies the entire process environment and passes it to a child script, effectively broadening the child's access to all ambient secrets rather than only the one API key it needs. In an agent platform, environment variables often carry highly sensitive tokens, making this an unnecessary secret-harvesting and propagation risk even if exfiltration is not explicit in this file.

Content

Scanner excerpt · scripts/stock_query_v2.py (reported line 157)May include surrounding context.

python
try:
        import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill advertises executable behavior that implies shell, network, environment, and file access, but it does not declare any explicit tool scope or permissions. In an agent environment, missing scope boundaries increases the chance of overbroad execution and makes it harder to enforce least privilege, especially since the workflow runs Python scripts and may access local resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation guidance lists broad phrases such as “大盘怎么样” and keyword triggers like “查股票” / “股票行情” / “stock price” without clear exclusion conditions. These phrases are common and lack constraints on when the skill should or should not activate, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script accesses a sensitive credential file without any user-facing disclosure, despite presenting itself as a straightforward market-data tool. Hidden secret access is dangerous because it normalizes privilege use without consent and can surprise operators who assume the tool is low-risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

For a stock quote skill, fetching remote data is expected, but invoking another Python program through subprocess introduces code execution and trust in an external skill/toolchain. That is a broader capability than straightforward in-process quote retrieval and is not disclosed by the manifest's simple quote-query description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The function invokes another Python script via subprocess.run to query external market data, but there is no clear warning to the user that an external helper script will be executed. This is a safety-relevant operation under the rule because subprocess execution can have system effects beyond simple in-process computation.

Content

No source excerpt is available for this finding.

Tainted flow: 'env' from os.environ.get (line 157, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/stock_query.py (reported line 159)May include surrounding context.

python
import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code}.HK 最新价'],
            capture_output=True,

Tainted flow: 'env' from os.environ.get (line 157, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/stock_query.py (reported line 200)May include surrounding context.

python
# 第二次查询：获取涨跌幅
        change_pct = 0
        try:
            result2 = subprocess.run(
                ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
                 '--query', f'{code}.HK 涨跌幅'],
                capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends stock query data to the Tencent finance endpoint over the network, but the user-facing description does not clearly warn that input symbols will be transmitted to third-party services. While remote fetching is part of the script's functionality, the current help text does not explicitly disclose the outbound network behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The single-query function makes an HTTP request to the Tencent finance API, but there is no direct user-facing notice at this call site or in the command help that an external request will be made. This lacks the disclosure expected for network transmission of user-provided query data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata and comments claim no API key is required, but the Hong Kong quote path loads an Eastmoney API key from environment or a vault file. This is dangerous because it obscures secret usage from operators and users, undermining informed consent and making the skill appear less sensitive than it really is.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads a credential file from a fixed vault path as part of ordinary quote lookup behavior, expanding the skill's privilege and secret-access scope beyond what its simple functionality suggests. In shared agent environments, hardcoded secret-path access can expose unrelated credentials to code paths that should not need them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill accesses credentials and sends data to external services without clearly disclosing that behavior to the user. Lack of transparency is risky in agent settings because users may assume a harmless local lookup while the code actually consumes secrets and communicates with third parties.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill delegates work to a Python script located in another skill's directory, creating a risky trust-boundary crossing. If that external skill is modified, compromised, or less trusted, this stock-query skill becomes a vehicle for executing unreviewed code with access to its inherited secrets and runtime context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stock_query.py (reported line 159)May include surrounding context.

python
import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code}.HK 最新价'],
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stock_query_v2.py (reported line 159)May include surrounding context.

python
import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code}.HK 最新价'],
            capture_output=True,

Tainted flow: 'env' from os.environ.get (line 157, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
94% confidence
Finding

The code forwards the entire parent environment into an external Python script from another skill while also injecting an API key. In a skill-execution environment, inherited environment variables may contain credentials, tokens, or internal configuration, so this creates a cross-skill secret exposure channel if the helper script is compromised or behaves unexpectedly.

Content

Scanner excerpt · scripts/stock_query_v2.py (reported line 159)May include surrounding context.

python
import subprocess
        env = {**os.environ, 'EM_API_KEY': em_api_key}
        # 分两次查询：先获取最新价，再获取涨跌幅
        result = subprocess.run(
            ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
             '--query', f'{code}.HK 最新价'],
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stock_query.py (reported line 200)May include surrounding context.

python
# 第二次查询：获取涨跌幅
        change_pct = 0
        try:
            result2 = subprocess.run(
                ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
                 '--query', f'{code}.HK 涨跌幅'],
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/stock_query_v2.py (reported line 200)May include surrounding context.

python
# 第二次查询：获取涨跌幅
        change_pct = 0
        try:
            result2 = subprocess.run(
                ['python3', '/root/.openclaw/workspace/skills/mx-finance-data/scripts/get_data.py',
                 '--query', f'{code}.HK 涨跌幅'],
                capture_output=True,

Static analysis

No suspicious patterns detected.