ClawHub
Back to skill

Security audit

finance_monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs a disclosed local finance-data fetch, but its documentation unnecessarily asks users to provide and persist a Finnhub API key that the code does not use.

Before installing, understand that the code fetches public CNBC quote pages and writes a local SQLite database plus log. Do not provide a Finnhub API key or place one in cron/OpenClaw scheduler config for this version. Use explicit db/log paths, review any recurring task before enabling it, and prefer manual runs until the documentation is corrected.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:156
Finding

Unnecessary Plaintext API Key Stored in Persistent Scheduler Configuration

Content
View full analysis
> ~/finance/fetch.log 2>&1 ``` ```text ### Windows 任务计划程序 1. 创建基本任务，触发器：每小时 2. 操作：启动程序 → `py` 3. 参数：`fetch_data.py --db-path C:\Users\你\finance\finance.db` 4. 在用户环境变量中设置 `FINNHUB_API_KEY=你的key` ``` ```json { "cron": "0 * * * *", "command": "python3", "args": ["fetch_data.py", "--db-path", "~/finance/finance.db"], "env": { "FINNHUB_API_KEY": "你的key" }, "workdir": "~/finance" } ``` ### Technical Analysis The documentation instructs users to place a Finnhub API key directly into crontab, an OpenClaw cron environment object, or a persistent user environment variable. These locations may be exposed through scheduler inspection tools, configuration exports, backups, diagnostics, or compromise of the same user account. This credential is not necessary for the implemented functionality. `scripts/fetch_data.py` only performs unauthenticated HTTPS requests to fixed CNBC quote URLs. Its argument parser does not support `--finnhub-key`, and the script does not read `FINNHUB_API_KEY`. Persisting the key therefore exceeds the minimum privileges and information required by the Skill. The scheduled execution itself is visible, explicitly configured by the user, and aligned with periodic financial monitoring. It is not evidence of a covert backdoor. The vulnerability is the unnecessary persistence and exposure of a real credential within scheduler configuration. ### Attack Path 1. A user follows `SKILL.md` and substitutes a real Finnhub API key for the placeholder. 2. The key is saved in crontab, OpenClaw scheduler configuration, or the user's persistent environment. 3. A local process, diagnostic u ...[truncated 1043 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 2)May include surrounding context.

text
# Environment
.env
.env.local
.env.*.local

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 3)May include surrounding context.

text
# Environment
.env
.env.local
.env.*.local

# Database

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The manifest says the skill uses CNBC data and needs no API key, but the body instructs users to obtain and supply a Finnhub API key. This mismatch can mislead users and reviewers about external dependencies and secret handling, causing accidental credential disclosure or trust in a different data flow than advertised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation contradicts itself on both source of truth and authentication requirements, alternating between CNBC real-time scraping and Finnhub-key-based access. Contradictory operational instructions are dangerous because they obscure what network destinations will be contacted and what credentials are needed, undermining informed consent and security review.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope even though its documented behavior requires network access and local file/database writes. Without permission boundaries, an agent may invoke broader capabilities than users expect, increasing the chance of unintended data writes or external requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description, headings, instructions, and trigger phrases are entirely in Chinese, which implicitly constrains interaction to a single language. There is no stated user choice, opt-in, or justification that this skill is intended only for a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases are generic enough that normal conversation about updating financial data could invoke the skill without clear user intent to perform network fetches and local database writes. In an agent setting, broad activation criteria can lead to unintended execution, scheduled persistence, or modification of user files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly instructs users to install a recurring cron job, creating persistence on the host. Persistence is security-relevant because it causes repeated unattended network access and file writes, and in the provided example the secret is embedded directly in the cron command, increasing exposure risk through shell history or system inspection.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

bash
# 编辑 crontab
crontab -e

# 添加（每小时整点执行）
0 * * * * cd ~/finance && FINNHUB_API_KEY=你的key /usr/bin/python3 fetch_data.py --db-path ~/finance/finance.db >> ~/finance/fetch.log 2>&1

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code hardcodes Chinese indicator names in the primary output data structure, and later prints those names directly to the user. That creates a language/locale constraint without any opt-in, selection mechanism, or explicit justification that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.