ClawHub
Back to skill

Security audit

Eastmoney News

Security checks for vulnerabilities and agentic risk

Overview

This is a finance-news search skill, but it ships a reusable API key and sends searches to a third-party service, so it needs review before installation.

Install only if you are comfortable with finance search terms being sent to the listed third-party API. The publisher should rotate the exposed API key, remove it from the package and documentation, and narrow the generic news trigger before this is treated as a routine install.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
search.py:7
Finding

Hard-Coded API Credential in Executable Source Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

API Credential Disclosed in Skill Documentation

Content
View full analysis
","variables":0}' ``` ### Technical Analysis The documentation publishes the same API key as the executable source code in a directly reusable `curl` command. Documentation is commonly distributed more broadly than implementation files and may be rendered on package registries, copied into support materials, indexed by search systems, or retained in repository history. A reader can execute the documented request after replacing the query placeholder, with no requirement to invoke the intended Skill implementation. This makes the credential disclosure directly exploitable. ### Attack Path 1. An attacker reads the distributed `SKILL.md` file or a copied/rendered version of it. 2. The attacker copies the documented `curl` command and extracts the plaintext `apikey` value. 3. The attacker substitutes an arbitrary search query and sends requests directly to the documented API endpoint. 4. Requests consume resources or quota associated with the exposed credential. 5. The attacker can automate further requests until server-side controls reject or invalidate the key. ### Impact Assessment The disclosure may enable unauthorized API calls, quota depletion, automated service abuse, and request activity attributed to the key owner. The exact data access and request limits depend on remote service configuration and cannot be established from the reviewed project. No evidence in the audited files indicates that this credential grants local-system access, privilege escalation, administrative access, or access beyond the remote API permissions assigned to the key. ]]>
Remediation
View remediation
","variables":0}' ``` 2. Revoke and rotate the disclosed key because removal from the document does not prevent reuse of existing copies. 3. Purge the secret from repository history, published packages, documentation sites, caches, and release artifacts where practical. 4. Use clearly synthetic and nonfunctional values in all examples. 5. Add automated secret scanning for Markdown and other documentation files, not only source code. 6. Configure rate limits, narrow API scopes, expiration, monitoring, and anomaly alerts for the replacement key. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation example "看看今天有什么新闻" is a generic, everyday request for news and is not clearly constrained to A-share or finance topics. This broad phrasing could cause unintended skill activation outside the intended domain.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill embeds a live API key directly in the documentation and instructs clients to send user-supplied queries to an external third-party endpoint. Hardcoded credentials can be harvested and abused, and the external transmission of potentially sensitive user prompts or investment-related interests creates confidentiality and misuse risks.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

API

bash
curl -X POST "https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search" \
  -H "Content-Type: application/json" \
  -H "apikey: mkt_o2fBS-Dkbt11c7vSNnlXjESgfybI8EXzzzX2XkOQVuE" \
  -d '{"query":"<搜索关键词>","variables":0}'

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file embeds a live static API key directly in source code, which is a credential exposure issue regardless of the docstring. Hardcoded secrets are easily leaked through source control, logs, package distribution, or reuse, enabling unauthorized API access, quota exhaustion, and possible access to associated backend data or billing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code accesses a hardcoded API credential with no protection or explanation, which is a direct secret-management failure. Anyone obtaining the code can reuse the credential to impersonate the skill, consume service quotas, or access any data and privileges tied to that key.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · search.py (reported line 21)May include surrounding context.

python
"size": size
    }
    
    resp = requests.post(API_URL, headers=headers, json=data, timeout=30)
    result = resp.json()
    
    if result.get("status") != 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code posts the user's search query to a remote service, which is a data-transmitting network operation covered by the warning requirement for code files. There is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that the query is sent to an external endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The top-level natural-language description is only in Chinese and does not offer any language or locale choice. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
search.py:8

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:16