ClawHub
Back to skill

Security audit

Betalpha Finance

Security checks for vulnerabilities and agentic risk

Overview

The skill’s finance-data purpose is coherent, but its setup instructions create avoidable API-token exposure risks that users should review before installing.

Install only if you trust ai.firstindex.cn and are comfortable storing a Betalpha API token locally. Configure the token manually rather than pasting it into chat, do not run verification commands that print the token, and rotate the token if it has already appeared in a chat transcript or terminal log.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:121
Finding

API Token Exposure Through Chat-Based Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:121-128
Additional Location: README.md:177-179
Vulnerability Type: Sensitive credential disclosure through conversation history
Risk Level: Medium

Vulnerable Documentation:

text
Method 1: Automatic configuration

Tell Claude your API Token, and Claude will configure it for you:

My API Token is: xxxxx

The README additionally states that directly providing the token in chat is supported, although not recommended.

Technical Analysis

The documented automatic configuration process asks the user to submit an API token directly through the AI conversation. API tokens are sensitive authentication credentials and should not be placed in chat transcripts.

Conversation content may be retained in application history, telemetry, debugging records, browser storage, support exports, screenshots, or model-provider logs. Merely advising users that this method is not recommended does not remove the risk because the workflow remains explicitly supported.

The token authenticates requests to ai.firstindex.cn through the X-API-Key request header. A party that recovers the token could therefore submit authenticated financial-data API requests under the affected user's identity.

Attack Path

  1. A user follows the documented automatic configuration procedure.
  2. The user enters the complete API token into the AI conversation.
  3. The conversation or related diagnostic data retains the credential.
  4. An unauthorized party obtains access to the retained transcript, exported conversation, screenshot, telemetry, or support record.
  5. The party extracts the token and places it in the X-API-Key header.
  6. The party makes authenticated requests to the Betalpha API as the affected user.

Impact Assessment

Successful exploitation exposes the privileges granted to the API token. An attacker could make authenticated requests as the user, consum ...[truncated 336 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove chat-based token configuration from SKILL.md and README.md.
  2. State unambiguously that users must never submit API tokens through an AI conversation.
  3. Use a non-echoing local credential prompt or an operating-system credential manager.
  4. If file storage remains necessary, create the file locally with restrictive permissions before writing the secret.
  5. Ensure the agent never includes the token in responses, logs, errors, tool-call summaries, or cached endpoint metadata.
  6. Document a token-revocation and rotation procedure for users who previously submitted a token through chat.
  7. Prefer short-lived, narrowly scoped tokens where supported by the service.

T09 · Insecure Skill Coding Practices

Warning
Location
POST_INSTALL.md:25
Finding

Complete API Token Printed During Configuration Verification

Content
View full analysis

Vulnerability Details

File Location: POST_INSTALL.md:25-27
Vulnerability Type: Plaintext credential disclosure through terminal output
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Verify configuration
cat ~/.config/betalpha/api_key.txt

Technical Analysis

The post-installation procedure verifies configuration by printing the entire contents of the API-token file. Because the file is documented as containing the raw token on its first line, this command exposes the complete credential on the terminal.

Restrictive file permissions such as mode 600 protect the file from direct access by other local users, but they do not protect the token after it is rendered on screen. The value may be captured by terminal logging, screen sharing, shell-session recording, screenshots, remote-support software, or copied terminal output.

This verification step is unnecessary. Configuration can be validated by checking that the file exists, is nonempty, and has restrictive permissions without displaying its contents.

Attack Path

  1. A user stores the API token in ~/.config/betalpha/api_key.txt.
  2. The user follows the documented verification step.
  3. The cat command prints the complete token to the terminal.
  4. Terminal history capture, session recording, screen sharing, a screenshot, or an observer records the displayed value.
  5. An unauthorized party extracts the token from that record.
  6. The party uses the token in an X-API-Key header to make authenticated API requests as the user.

Impact Assessment

The attacker obtains the full authority associated with the exposed API token, including authenticated use of the financial-data service and consumption of the user's applicable API quota. The precise account and data scope depends on server-side token permissions.

The issue does not independently provide local privilege escalation or arbitrary command execution.

Remediation
View remediation

Remediation Suggestions

Replace the token-printing command with checks that do not reveal file contents. For example:

bash
test -s ~/.config/betalpha/api_key.txt && echo "API token file is configured"
stat -c '%a %n' ~/.config/betalpha/api_key.txt

Additional hardening measures:

  1. Remove every instruction that prints or echoes an existing token.
  2. Validate that the file is owned by the current user and has mode 600.
  3. If format validation is required, display only a fixed redacted prefix and never the complete value.
  4. Warn users to rotate the token if it has been displayed during a recorded or shared terminal session.
  5. Prefer an operating-system secret store over a plaintext file where platform support is available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · POST_INSTALL.md (reported line 89)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 168)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · POST_INSTALL.md (reported line 89)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 168)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

bash
# 删除所有本地数据
rm -rf ~/.config/betalpha/

安全最佳实践：

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing instructions and the final usage directive require Chinese-language interaction, and no opt-in or alternative language option is provided. Under the policy, imposing a specific language without user choice is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

This duplicate finding points to the same behavior: creating a persistent config directory and storing the API token in plaintext for reuse across sessions. Persistent local credential storage expands the attack surface compared with ephemeral entry or managed secret stores.

Content

Scanner excerpt · POST_INSTALL.md (reported line 18)May include surrounding context.

Linux / macOS

bash
# 创建配置目录
mkdir -p ~/.config/betalpha

# 写入 Token（替换 YOUR_TOKEN_HERE 为您的实际 Token）
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

This duplicate finding points to the same behavior: creating a persistent config directory and storing the API token in plaintext for reuse across sessions. Persistent local credential storage expands the attack surface compared with ephemeral entry or managed secret stores.

Content

Scanner excerpt · POST_INSTALL.md (reported line 18)May include surrounding context.

Linux / macOS

bash
# 创建配置目录
mkdir -p ~/.config/betalpha

# 写入 Token(替换 YOUR_TOKEN_HERE 为您的实际 Token)
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · POST_INSTALL.md (reported line 24)May include surrounding context.

md
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

# 设置安全权限（仅您可读写）
chmod 600 ~/.config/betalpha/api_key.txt

# 验证配置
cat ~/.config/betalpha/api_key.txt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

md
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

# 设置安全权限（仅您可读写）
chmod 600 ~/.config/betalpha/api_key.txt

# 验证配置
cat ~/.config/betalpha/api_key.txt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

# 设置安全权限（仅您可读写）
chmod 600 ~/.config/betalpha/api_key.txt

# 验证配置
cat ~/.config/betalpha/api_key.txt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · metadata.json (reported line 75)May include surrounding context.

json
echo "YOUR_TOKEN_HERE" > ~/.config/betalpha/api_key.txt

# 设置安全权限（仅您可读写）
chmod 600 ~/.config/betalpha/api_key.txt

# 验证配置
cat ~/.config/betalpha/api_key.txt

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation example tells the user to say a very broad finance-related command without documenting clear routing constraints or disambiguation. In an agent environment, this can cause the skill to trigger on generic stock-price requests and capture prompts more broadly than intended, increasing the chance of unintended data access or invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill documentation is written in Chinese, including usage examples and safety disclosures, with no indication that users may interact in other languages or that the Chinese-only constraint is intentional and required. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The README instructs users to persist a long-lived API token in plaintext under ~/.config/betalpha/api_key.txt, creating a standing credential on disk. Even with restrictive permissions, plaintext secret storage increases the blast radius of local compromise, malware, backups, or accidental disclosure through tooling that reads home-directory config files.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

Linux/macOS:

bash
mkdir -p ~/.config/betalpha
echo "YOUR_API_TOKEN_HERE" > ~/.config/betalpha/api_key.txt
chmod 600 ~/.config/betalpha/api_key.txt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

bash
   mkdir -p ~/.config/betalpha
   echo "YOUR_API_TOKEN_HERE" > ~/.config/betalpha/api_key.txt
   chmod 600 ~/.config/betalpha/api_key.txt

Windows (PowerShell):

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing instructions, examples, prompts, and operational guidance are presented only in Chinese, including prescribed assistant responses. There is no indication that the user may choose another language, nor a documented justification that the skill is intentionally restricted to Chinese-language use.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · POST_INSTALL.md (reported line 98)May include surrounding context.

md
**安全最佳实践**：

- 使用独立目录存储配置，避免与其他应用混淆
- 定期检查文件权限：`ls -la ~/.config/betalpha/`
- 不要将配置文件加入版本控制（git）
- 在 `.gitignore` 中添加：`~/.config/betalpha/`

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
**安全最佳实践**：

- 使用独立目录存储配置，避免与其他应用混淆
- 定期检查文件权限：`ls -la ~/.config/betalpha/`
- 不要将配置文件加入版本控制（git）
- 在 `.gitignore` 中添加：`~/.config/betalpha/`

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly tells the user to send their API token to the assistant so the assistant can store it, encouraging disclosure of a secret in chat. This is dangerous because conversational channels, logs, telemetry, screenshots, or downstream integrations may retain the credential, increasing the risk of token compromise and unauthorized API use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs persistent storage of the API token in a local file under the user profile, creating a long-lived secret on disk. Although persistence is sometimes necessary, this increases the attack surface if the workstation is compromised, backups are exposed, or the file permissions are misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

bash
# Linux/Mac
mkdir -p ~/.config/betalpha
echo "YOUR_API_TOKEN" > ~/.config/betalpha/api_key.txt

# Windows (PowerShell)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger keywords are broad generic finance terms like '新闻', '股票', and '基金', which can cause the skill to activate for ordinary conversation outside the user’s intended scope. Over-broad activation increases the chance the agent will read local credentials and contact the external service unnecessarily, expanding both privacy and security exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.