ClawHub
Back to skill

Security audit

A股智投大师

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its A-share stock-analysis purpose, but it automatically installs unpinned dependency skills and can change a user watchlist through external API calls without a clear confirmation step.

Review before installing. This skill appears purpose-built for A-share analysis and does not show hidden local persistence or destructive local behavior, but installation may pull in several unreviewed dependency skills automatically. Only use it if you trust those dependencies and the East Money API integration, and be careful with prompts that add, delete, or monitor watchlist entries.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Automatic Installation of External Skills

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–12
Vulnerability Type: Unverified and unpinned third-party Skill dependencies
Risk Level: Medium

Vulnerable Code

yaml
"requires": 
  {
    "skills": ["mx-data", "mx-search", "mx-select-stock", "mx-selfselect", "stock-monitor-skill"],
    "action": "auto-install"
  },

Technical Analysis

The manifest directs the platform to automatically install five third-party Skills, but it does not pin immutable versions or commit hashes, identify verified publishers or source locations, or provide signatures or integrity hashes.

Consequently, mutable external components become part of the Skill's execution path without an explicit review or approval step. The dependencies were not included in the audited project, so their instructions and executable code could not be verified. If the dependency registry, publisher account, package-resolution process, or a referenced Skill is compromised, a malicious replacement could be installed automatically.

Attack Path

  1. An attacker compromises the publisher account, registry entry, or distribution channel for one of the named Skills, or causes the dependency resolver to select an attacker-controlled component.
  2. The attacker publishes a malicious revision under the expected dependency name.
  3. The platform processes this manifest and honors "action": "auto-install".
  4. The modified dependency is installed without version or integrity verification and without explicit user approval.
  5. When the dependency is loaded or invoked, its malicious instructions or code execute within the permissions available to the Agent.
  6. The dependency may access data and credentials exposed to its runtime, including configured financial-service API credentials, subject to the host platform's isolation controls.

Impact Assessment

Successful exploitation could allow attacker-controlled instructions or code to run with the permissions granted to the A ...[truncated 530 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic installation and require explicit user or administrator approval before adding third-party Skills.
  2. Pin every dependency to an immutable, reviewed version or commit hash.
  3. Resolve dependencies only from an allowlisted registry and require verified publisher identities.
  4. Verify cryptographic signatures or published integrity hashes before installation.
  5. Vendor or otherwise retain the reviewed dependency source so later installations cannot silently resolve to different content.
  6. Audit each dependency's instructions, scripts, transitive dependencies, network destinations, and credential access before activation.
  7. Run dependencies with least privilege and isolate their filesystem, network, tool, and secret access.
  8. Establish lockfile-based reproducibility and continuous monitoring for dependency ownership changes, withdrawn releases, and integrity failures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The manifest declares auto-installed dependent skills and documents use of an API key and external data access, but it does not define an explicit tool/permission scope. That creates a least-privilege gap: the runtime may permit broader environment or network access than users or reviewers can easily verify, increasing the risk of unexpected data access or outbound requests through this skill chain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The keyword list includes broad finance and lifestyle terms such as '投资', '理财', and '副业', which can cause the skill to trigger for generic financial conversations beyond A-share stock analysis. Over-broad activation increases the chance that users are routed into a skill that requests or uses market-data credentials and investment-oriented tooling when the request did not clearly warrant it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill is written entirely in Chinese and all example commands, role instructions, and outputs assume Chinese interaction, but there is no statement that the skill is China/A-share-specific in a way that explicitly constrains language behavior or offers an opt-in choice. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The quick commands are short, generic phrases like '查[股票]' and '分析[股票]' without disambiguation rules or confirmation requirements. In practice, such triggers may match ordinary conversation and invoke data queries, watchlist access, or monitoring actions unexpectedly, especially for the more state-changing monitor flow.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 34)May include surrounding context.

python
data = {"toolQuery": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 46)May include surrounding context.

python
data = {"toolQuery": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 81)May include surrounding context.

python
data = {"toolQuery": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The self-select management method can perform state-changing add/delete operations based on a free-form query string, but the code contains no confirmation, authorization boundary, dry-run mode, or user-facing warning before invoking the remote API. In an agent skill context, this increases the risk of unintended portfolio/watchlist modifications from ambiguous prompts, prompt injection, or accidental tool use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This request transmits a free-form query to a remote endpoint that performs state-changing self-select management actions. In the context of an agent skill, combining outbound transmission with account-modifying behavior and no confirmation makes accidental or adversarially induced watchlist changes more dangerous than ordinary read-only API calls.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 69)May include surrounding context.

python
data = {"query": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON defines all indicator names, descriptions, and analysis text exclusively in Chinese, with no accompanying opt-in, locale selection, or justification that the skill is intended only for a Chinese-speaking or China-market context. Under the language/locale policy, hard-coding a single language across user-facing content can be a policy violation when no choice is offered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file reads MX_API_KEY or MX_SEARCH_API_KEY from environment variables and uses the value for authenticated API requests. Although this may be functionally necessary, the code does not include any user-facing notice, comment, or broader warning that credentials from the environment will be accessed and transmitted in request headers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.