finance_monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:30 AM UTC
• Version: 1.0.4

Overview

The skill mostly performs a disclosed local finance-data fetch, but its documentation unnecessarily asks users to provide and persist a Finnhub API key that the code does not use.

Before installing, understand that the code fetches public CNBC quote pages and writes a local SQLite database plus log. Do not provide a Finnhub API key or place one in cron/OpenClaw scheduler config for this version. Use explicit db/log paths, review any recurring task before enabling it, and prefer manual runs until the documentation is corrected.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:156
• Finding: Unnecessary Plaintext API Key Stored in Persistent Scheduler Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 156–179 **Vulnerability Type**: Plaintext credential exposure in persistent configuration **Risk Level**: Medium ### Vulnerable Code ```bash # 编辑 crontab crontab -e # 添加（每小时整点执行） 0 * * * * cd ~/finance && FINNHUB_API_KEY=你的key /usr/bin/python3 fetch_data.py --db-path ~/finance/finance.db >> ~/finance/fetch.log 2>&1 ``` ```text ### Windows 任务计划程序 1. 创建基本任务，触发器：每小时 2. 操作：启动程序 → `py` 3. 参数：`fetch_data.py --db-path C:\Users\你\finance\finance.db` 4. 在用户环境变量中设置 `FINNHUB_API_KEY=你的key` ``` ```json { "cron": "0 * * * *", "command": "python3", "args": ["fetch_data.py", "--db-path", "~/finance/finance.db"], "env": { "FINNHUB_API_KEY": "你的key" }, "workdir": "~/finance" } ``` ### Technical Analysis The documentation instructs users to place a Finnhub API key directly into crontab, an OpenClaw cron environment object, or a persistent user environment variable. These locations may be exposed through scheduler inspection tools, configuration exports, backups, diagnostics, or compromise of the same user account. This credential is not necessary for the implemented functionality. `scripts/fetch_data.py` only performs unauthenticated HTTPS requests to fixed CNBC quote URLs. Its argument parser does not support `--finnhub-key`, and the script does not read `FINNHUB_API_KEY`. Persisting the key therefore exceeds the minimum privileges and information required by the Skill. The scheduled execution itself is visible, explicitly configured by the user, and aligned with periodic financial monitoring. It is not evidence of a covert backdoor. The vulnerability is the unnecessary persistence and exposure of a real credential within scheduler configuration. ### Attack Path 1. A user follows `SKILL.md` and substitutes a real Finnhub API key for the placeholder. 2. The key is saved in crontab, OpenClaw scheduler configuration, or the user's persistent environment. 3. A local process, diagnostic u ...[truncated 1043 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all Finnhub credential instructions from `SKILL.md` because the current implementation only retrieves public CNBC pages and does not use Finnhub. 2. Remove the documented `--finnhub-key` option because `scripts/fetch_data.py` does not implement it. 3. Remove `FINNHUB_API_KEY` from all crontab, OpenClaw cron, Windows Task Scheduler, and usage examples. 4. If Finnhub support is added later, retrieve the key at runtime from an operating-system credential manager or another dedicated secret-management facility. 5. If a secret file is unavoidable, store it outside the repository, restrict its permissions to the owning account, and reference the file rather than embedding the key in scheduler configuration. 6. Ensure logs and error messages never include credential values. 7. Document how users can inspect and remove installed scheduled tasks. 8. Require explicit user approval before creating any recurring task, and provide a non-persistent manual execution option as the default. 9. Revoke and rotate any real Finnhub key that was previously placed in scheduler configuration. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

# Environment
.env
.env.local
.env.*.local

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Environment
.env
.env.local
.env.*.local

# Database

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The manifest says the skill uses CNBC data and needs no API key, but the body instructs users to obtain and supply a Finnhub API key. This mismatch can mislead users and reviewers about external dependencies and secret handling, causing accidental credential disclosure or trust in a different data flow than advertised.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation contradicts itself on both source of truth and authentication requirements, alternating between CNBC real-time scraping and Finnhub-key-based access. Contradictory operational instructions are dangerous because they obscure what network destinations will be contacted and what credentials are needed, undermining informed consent and security review.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no explicit tool scope even though its documented behavior requires network access and local file/database writes. Without permission boundaries, an agent may invoke broader capabilities than users expect, increasing the chance of unintended data writes or external requests.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The manifest description, headings, instructions, and trigger phrases are entirely in Chinese, which implicitly constrains interaction to a single language. There is no stated user choice, opt-in, or justification that this skill is intended only for a Chinese-language or region-specific audience.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are generic enough that normal conversation about updating financial data could invoke the skill without clear user intent to perform network fetches and local database writes. In an agent setting, broad activation criteria can lead to unintended execution, scheduled persistence, or modification of user files.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加（每小时整点执行）
0 * * * * cd ~/finance && FINNHUB_API_KEY=你的key /usr/bin/python3 fetch_data.py --db-path ~/finance/finance.db >> ~/finance/fetch.log 2>&1

• Confidence: 85% confidence
• Finding: The skill explicitly instructs users to install a recurring cron job, creating persistence on the host. Persistence is security-relevant because it causes repeated unattended network access and file writes, and in the provided example the secret is embedded directly in the cron command, increasing exposure risk through shell history or system inspection.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code hardcodes Chinese indicator names in the primary output data structure, and later prints those names directly to the user. That creates a language/locale constraint without any opt-in, selection mechanism, or explicit justification that the skill is intended only for Chinese-speaking users.

Static analysis

No suspicious patterns detected.