Security audit

港股+A股盯盘系统

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real stock-monitoring tool, but it includes hardcoded external messaging and API credentials that users may not control.

Review before installing. Replace the Feishu chat ID in every script, remove and rotate the embedded QVeris key, require secrets through environment variables, avoid running the cron jobs until destinations are verified, and prefer hardened subprocess calls or direct APIs before using this in any account that holds private investment or business data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

other

Error

Location: scripts/data-sources.js:12
Finding: Stock monitoring alerts are transmitted to a hardcoded Feishu recipient
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/alert-check.js:78
Finding: Shell command injection risk in Feishu alert delivery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/data-sources.js:164
Finding: QVeris fallback constructs shell commands from environment and configuration values
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/data-sources.js:12
Finding: QVeris API credential is hardcoded in project source files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: If the associated implementation contains a hardcoded API key, fixed Feishu destination, and undeclared local persistence, that is a real security issue because it mixes secret exposure, outbound data transmission, and undeclared stateful behavior. In the context of a stock-monitoring skill that pushes messages externally, undocumented secrets and hardcoded recipients increase the risk of data leakage, account abuse, and unauthorized notification routing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the associated implementation contains a hardcoded API key, fixed Feishu destination, and undeclared local persistence, that is a real security issue because it mixes secret exposure, outbound data transmission, and undeclared stateful behavior. In the context of a stock-monitoring skill that pushes messages externally, undocumented secrets and hardcoded recipients increase the risk of data leakage, account abuse, and unauthorized notification routing.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the associated implementation contains a hardcoded API key, fixed Feishu destination, and undeclared local persistence, that is a real security issue because it mixes secret exposure, outbound data transmission, and undeclared stateful behavior. In the context of a stock-monitoring skill that pushes messages externally, undocumented secrets and hardcoded recipients increase the risk of data leakage, account abuse, and unauthorized notification routing.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
编辑 `scripts/data-sources.js`：

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded fallback API key is a real secret exposure. Anyone with access to the skill source can extract and abuse the credential for unauthorized paid API usage, billing fraud, quota exhaustion, or downstream access associated with the account.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A live-looking API key is hardcoded as a fallback in source code, exposing a credential to anyone who can read the repository, package, logs, or deployed artifact. An attacker could reuse the key for unauthorized third-party API access, consume quota, incur charges, or access data/functions under the owner's account.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The fallback behavior silently uses an embedded API credential without informing the operator, which hides external authenticated access and makes misuse harder to detect. Combined with the hardcoded secret, this increases the chance of unapproved data exchange, surprise billing, and unnoticed credential abuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises executable scripts and configuration that imply environment and external-service usage, but it does not declare any explicit tool scope, permissions, or secret handling expectations. This creates a transparency and least-privilege problem: operators may enable broader access than intended, and reviewers cannot reliably assess what capabilities the skill needs before execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly describes Feishu/Telegram alerting but does not warn that stock symbols, alert conditions, report contents, or operational metadata may be transmitted to third-party messaging services. In this context, outbound messaging is core functionality, so missing disclosure materially increases privacy and governance risk, especially in enterprise environments where chat destinations may be broadly accessible.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script’s natural-language title and operational descriptions are entirely in Chinese and the implementation is tailored to Beijing time and China/HK market context, without offering any language or locale choice. This can violate language/locale policy when a skill forces one locale-specific experience without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented rules enumerate only rise/fall alerts over 4.9% and no-message behavior, presenting them as the script's alerting rules. The implementation adds price-target alerts for configured stocks and volume-related alerts at a 2% move threshold, which materially extends behavior beyond the documented rules.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file header states '每只股票每天最多告警1次', implying a single alert per stock per day. In implementation, the state is tracked separately for change, price-target, and volume alerts using distinct keys like ${code}_change, ${code}_price_${target}, and ${code}_volume, so one stock may generate several alerts in one day.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a stock monitoring system with行情查询、告警和推送, which reasonably implies network access and messaging, but this file also imports child_process and uses execSync to invoke external CLI tooling and another script. Spawning shell commands is a materially broader capability than ordinary quote retrieval or report generation and is not explicitly justified by the stated purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module executes a script from another skill/workspace path, creating a trust-boundary violation: this skill inherits code and behavior from an external location that may be modified independently. That expands the attack surface and can lead to arbitrary code execution or unauthorized data access if the external script is replaced or tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The sendAlert function invokes a shell command to send messages to a Feishu channel, which is an external side effect involving subprocess execution and outbound communication. The code logs success only after sending, but it does not provide any prior warning, confirmation, or explanatory comment that runtime failures will trigger external notifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code transmits stock codes to an external paid service by constructing a shell command with interpolated data, without validation or safe argument passing. If stock codes are ever influenced by untrusted input, this creates command-injection risk locally and data-exposure risk externally; even with trusted inputs, it silently exfiltrates monitored symbols to a third party.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The natural-language descriptions, console output, and generated report content are written in Chinese throughout the file, with no indication that users can choose another language or locale. This can violate language/locale policy when a skill unconditionally forces one language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest claims technical analysis and monitoring, but this code goes further by producing action-oriented recommendations such as '减仓', '止损', and '持有/逢低加仓'. That changes the skill from descriptive analytics toward investment decision guidance, which is a meaningful intent expansion.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes real-time quote lookup, alert monitoring, technical analysis, and scheduled report pushing, but does not mention retaining historical market data locally for 6 months. This file writes daily JSON snapshots and later-generated reports to disk, which is a broader operational behavior than the stated user-facing functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The configuration example exposes the use of a Feishu chat ID without any warning that messaging identifiers are sensitive operational metadata and should be handled carefully. Although a chat ID alone is not usually a secret on the level of an API token, documenting external-service identifiers without safety guidance can lead to misdelivery, accidental disclosure, or unsafe copy-paste practices alongside real credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file uses Chinese throughout for headings and instructions, which can amount to a language/locale constraint for users who do not read Chinese. The policy allows locale constraints when they are explicitly justified or when users are offered a choice, neither of which appears in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code persists alert state to /root/.openclaw/workspace/stock-monitor/data/alert-state.json, which is a file write affecting local user/system data. Although the code is clear to a developer, there is no confirmation prompt or user-facing notice around this persistent write in the script itself.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Feishu push notifications are within the skill's stated purpose, but implementing them through execSync('openclaw message send ...') gives the module shell command execution powers unrelated to the core business intent. This is broader than necessary for a monitoring skill and increases the capability surface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The alert message uses toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }), which hardcodes a specific language/locale and regional time zone. The file does not indicate that this locale choice is optional, user-selected, or justified as region-specific behavior.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/alert-check.js:81

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/data-sources.js:46