T04 · Embedded Malicious Code
Error
- Location
scripts/stock_pre.py:7- Finding
Hardcoded WeChat Recipient Causes Unauthorized Disclosure of Portfolio Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Push
Security checks for vulnerabilities and agentic risk
Overview
This stock alert skill is mostly consistent with its stated purpose, but it installs automatic root-level jobs and can send stock information to a hardcoded WeChat recipient unless users manually edit it first.
Review carefully before installing. Do not run the installer as-is on a real system unless you first remove the hardcoded WeChat ID, configure your own recipient and holdings in a safer configuration file, avoid root cron where possible, and verify any installed archive by hash or signature. Also check and remove /etc/cron.d/stock-monitor and /etc/logrotate.d/stock-monitor if you test it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T06 · System Persistence
Error
- Location
install.sh:51- Finding
Installer Creates Persistent Scheduled Tasks That Execute Skill Code as Root
- Content
View full analysis
"$CRON_FILE" << 'CRONEOF' SHELL=/bin/bash PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # Stock push cron jobs (system-level and independent of Gateway) # Pre-market recommendation: 09:20, Monday through Friday 20 9 * * 1-5 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_pre.py >> /tmp/stock_pre.log 2>&1 # Post-market review: 15:05, Monday through Friday 5 15 * * 1-5 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_after.py >> /tmp/stock_after.log 2>&1 # Next-day watch: 20:00, Monday through Thursday 0 20 * * 1-4 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_next.py >> /tmp/stock_next.log 2>&1 CRONEOF chmod 644 "$CRON_FILE" ``` ```bash # install.sh:86-89 # 5. Restart cron if command -v systemctl &>/dev/null; then systemctl restart cron 2>/dev/null && echo " ✅ cron service restarted" || echo " ⚠️ Unable to restart cron; restart it manually" fi ``` The Python installer creates equivalent system-level entries: ```python # scripts/install.py:49-66 # 4. Write cron configuration cron_content = """SHELL=/bin/bash PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # Stock push cron jobs (system-level and independent of Gateway) # Pre-market recommendation: 09:20, Monday through Friday 20 9 * * 1-5 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_pre.py >> /tmp/stock_pre.log 2>&1 # Post-market review: 15:05, Monday through Friday 5 15 * * 1-5 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_after.py >> /tmp/stock_after.log 2>&1 # Next-day watch: 20:00, Monday through Thursday ...[truncated 2102 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.py:10- Finding
Unverified Skill Archives Are Installed and Subsequently Executed by Root Cron Jobs
- Content
View full analysis
/dev/null; then echo " 🔧 Detected clawhub; attempting installation..." if clawhub install stock-push --force 2>/dev/null; then echo " ✅ clawhub installation succeeded" else echo " ⚠️ clawhub installation failed; falling back to manual extraction" fi fi if [ ! -d "$SKILL_DIR" ]; then echo " 📂 Skill directory does not exist; creating it..." mkdir -p "$(dirname $SKILL_DIR)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SKILL_FILE="" for f in ...[truncated 2709 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_pre.py:9- Finding
Root Jobs Write to Predictable Log Files in a Shared Temporary Directory
- Content
View full analysis
"$LOGROTATE_FILE" << 'LOGEOF' /tmp/stock_pre.log /tmp/stock_after.log /tmp/stock_next.log { daily rotate 7 compress delaycompress notifempty missingok create 0644 root root } LOGEOF ``` ### Technical Analysis The scripts use fixed filenames under the shared, world-writable `/tmp` directory. They open those paths in append mode without checking whether the target is a regular file, without using `O_NOFOLLOW`, and without validating ownership. Because the jobs are configured to run as root, a hostile filesystem object at one of these predictable paths may influence a privileged write. On systems without effective pro ...[truncated 1618 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (32)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a general stock push and holdings assistant, yet the detected behavior indicates only a subset of promised functions plus undisclosed outbound messaging to a hardcoded target. In a security review context, that discrepancy increases the risk of covert data transfer and unauthorized automation under a misleading description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill is presented as a general stock push and holdings assistant, yet the detected behavior indicates only a subset of promised functions plus undisclosed outbound messaging to a hardcoded target. In a security review context, that discrepancy increases the risk of covert data transfer and unauthorized automation under a misleading description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill is presented as a general stock push and holdings assistant, yet the detected behavior indicates only a subset of promised functions plus undisclosed outbound messaging to a hardcoded target. In a security review context, that discrepancy increases the risk of covert data transfer and unauthorized automation under a misleading description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill is presented as a general stock push and holdings assistant, yet the detected behavior indicates only a subset of promised functions plus undisclosed outbound messaging to a hardcoded target. In a security review context, that discrepancy increases the risk of covert data transfer and unauthorized automation under a misleading description.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Trigger phrases such as generic references to '推送' or '股票' are overly broad and can cause the skill to activate during ordinary conversation unrelated to consent for automated messaging or holdings disclosure. Because this skill can initiate stock-data processing and outbound WeChat transmission, over-triggering materially raises privacy and misuse risk.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 91% confidence
- Finding
The installer executes shell commands via os.system(), which invokes a shell and is unsafe as a general pattern in privileged installation code. In this file the current command strings are mostly constant and not directly attacker-controlled, so the immediate exploitability is limited, but the script runs as root and performs filesystem/archive operations, making any future variable interpolation or path manipulation especially risky.
- Content
python LOGROTATE_CONF = "/etc/logrotate.d/stock-monitor" def run(cmd): r = os.system(cmd) if r != 0: print(f"❌ 命令失败: {cmd}") sys.exit(r)
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 88% confidence
- Finding
Using os.system() for syntax checking unnecessarily spawns a shell in a root-run installer. The interpolated path is currently derived from a fixed filename list, so this specific instance is not highly exploitable by itself, but it still normalizes unsafe command execution practices in a privileged script.
- Content
python # 6. 验证脚本语法 for script in ["stock_pre.py", "stock_after.py", "stock_next.py"]: path = f"/root/.openclaw/workspace/skills/stock-push/scripts/{script}" r = os.system(f"python3 -m py_compile {path}") if r != 0: print(f" ❌ {script} 语法检查失败") else:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares operational behavior involving network access, shell execution, and file writes, but does not declare any explicit tool scope or permissions. This undermines least-privilege controls and makes it harder for reviewers or runtime policy to understand and constrain what the skill is allowed to do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation describes automatic transmission of holdings and market information to WeChat but does not clearly warn users about the privacy implications or require explicit informed consent. Financial holdings data is sensitive, and silent or background forwarding to external messaging channels can expose personal investment positions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill is presented primarily in Chinese and is tightly scoped to A-share workflows without offering the user a language or locale choice. This can violate language/locale policy when the skill effectively assumes a specific language and regional context without explicit opt-in or justification in the policy sense.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh #!/bin/bash # ========================================================= # stock-push 一键安装脚本（单机版） # 用法: bash <(curl -sL <url-to-this-script>) # 或直接: bash install_stock_push.sh # ========================================================= set -e
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The installer writes persistent host-level configuration into /etc/cron.d and /etc/logrotate.d, which affects the whole system rather than only the skill's own workspace. For a stock notification skill, this is broader-than-necessary privilege and creates persistence outside the application boundary, increasing risk if the skill files are modified or later abused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script makes persistent system changes by creating cron and logrotate entries and attempting to restart cron, but it does not present an upfront warning or obtain consent before doing so. This is dangerous because users may run it as root without realizing it is modifying host-wide scheduling and logging behavior.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # 次日关注：20:00（周一~四） 0 20 * * 1-4 root python3 /root/.openclaw/workspace/skills/stock-push/scripts/stock_next.py >> /tmp/stock_next.log 2>&1 CRONEOF chmod 644 "$CRON_FILE" echo " ✅ cron 已写入 $CRON_FILE" # 4. 写 logrotate
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Restarting the system cron service is a host-administrative action that impacts more than this skill alone and can affect unrelated scheduled jobs. Even if intended to activate the new schedule, doing so from a skill installer expands blast radius and assumes privileged control over the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The installer performs filesystem changes, archive extraction, and copying into privileged locations without explicit user confirmation. In a root context, unattended extraction and copying of remotely sourced content meaningfully increase risk, especially because archive contents are trusted implicitly and then used to establish persistent scheduled tasks later in the install flow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer downloads a skill archive from a remote URL and installs it without any integrity verification such as a pinned hash or signature check. In the context of a root-run installer, this is dangerous because a repository compromise, DNS/TLS interception edge case, or URL substitution could result in arbitrary code being installed and then later executed by cron.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer performs broad system administration by writing files under /etc/cron.d and /etc/logrotate.d, creating persistent scheduled execution as root. That exceeds simple skill installation and materially increases blast radius: any malicious or compromised installed script will run automatically with elevated privileges on a recurring basis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script silently writes system cron and logrotate configuration files without prior confirmation or a clear upfront warning, creating persistence and changing host behavior. While this is not an exploit primitive by itself, it is a security-significant installation practice because it can surprise operators and make unauthorized recurring execution harder to notice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script contains a hardcoded WeChat recipient and automatically sends outbound messages without runtime consent, confirmation, or recipient verification. In an agent skill context, this can silently exfiltrate portfolio information or operational data to an unintended third party, especially if the skill is triggered broadly by stock-related prompts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains natural-language docstrings, logs, and outbound message content entirely in Chinese, but it does not offer any language/locale opt-in or explain that the skill is intended only for Chinese-speaking users. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This script automatically sends stock summaries to a hard-coded external WeChat recipient without runtime confirmation, opt-in, or clear disclosure in the code path. In an agent-skill context, silent outbound transmission can leak portfolio interests, monitoring habits, or other sensitive financial metadata to an unintended destination if the skill is reused, misconfigured, or triggered unexpectedly.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python """发送消息，带重试机制""" for attempt in range(1, retries + 1): try: result = subprocess.run( ["openclaw", "message", "send", "--channel", "openclaw-weixin", "--target", USER_ID,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python """发送消息，带重试机制""" for attempt in range(1, retries + 1): try: result = subprocess.run( ["openclaw", "message", "send", "--channel", "openclaw-weixin", "--target", USER_ID,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python """发送消息，带重试机制""" for attempt in range(1, retries + 1): try: result = subprocess.run( ["openclaw", "message", "send", "--channel", "openclaw-weixin", "--target", USER_ID,
Static analysis
No suspicious patterns detected.