A股上市公司公告

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.1

Overview

The skill appears to do what it claims, but it sends stock-announcement searches over unencrypted HTTP and installs loosely constrained dependencies.

Review before installing. Use this only in an environment where outbound requests to SZSE and SSE are acceptable, avoid sensitive search terms, and do not rely on returned announcements for financial decisions unless the transport is changed to verified HTTPS or independently checked. Pin dependencies and remove the unused openclaw requirement before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: stock_plugin.py:72

Finding

Unauthenticated HTTP Allows Stock Announcement Response Tampering

Content

View full analysis

Vulnerability Details

File Location: stock_plugin.py:72, stock_plugin.py:115-117, and stock_plugin.py:146
Vulnerability Type: Cleartext communication with external exchange APIs
Risk Level: Medium

Vulnerable Code

python

url = "http://www.szse.cn/api/disc/announcement/annList?random=" + str(time.time())

python

url = "http://query.sse.com.cn/infodisplay/queryLatestBulletinNew.do"
headers = {
    "Referer": "http://www.sse.com.cn/",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}

python

link = f"http://www.sse.com.cn{url_path}"

Technical Analysis

Both exchange integrations communicate over unauthenticated plaintext HTTP. HTTP provides neither transport confidentiality nor server authenticity and does not protect responses against modification in transit.

An attacker capable of observing or modifying network traffic—such as a malicious Wi-Fi operator, compromised router, proxy, or upstream network participant—can inspect query parameters and replace the returned JSON. The plugin accepts announcement titles, identifiers, publication dates, security codes, and URL paths from these responses without authenticity verification, then presents the resulting strings to the user or calling AI agent.

The Shanghai Stock Exchange result link is also constructed with HTTP, allowing subsequent navigation to be intercepted or redirected. Although HTTPS links are produced for Shenzhen announcement details, the Shenzhen API response used to construct those links is still retrieved over HTTP.

Attack Path

1. A user or agent invokes query_announcements.
2. The plugin sends the query to an exchange endpoint over plaintext HTTP.
3. An attacker with a network interception position captures the request.
4. The attacker returns a forged HTTP response containing modified announcement titles, stock codes, identifiers, dates, or URL paths. 5 ...[truncated 859 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every exchange endpoint, referer, and generated result link with its verified HTTPS equivalent.
2. Allow redirects only when the destination remains on an approved exchange hostname and uses HTTPS.
3. Reject HTTPS-to-HTTP downgrade redirects.
4. Retain TLS certificate verification and do not introduce verify=False.
5. Validate response structures and field types before processing them.
6. Validate returned paths and identifiers before constructing links; reject absolute URLs or unexpected hostnames supplied by a response.
7. Treat all remote announcement text as untrusted content when forwarding it to an AI agent or rendering it in another interface.
8. Return a clear error if a secure endpoint is unavailable rather than silently falling back to HTTP.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Mutable and Unnecessary Third-Party Dependency Increases Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Insufficiently constrained and unnecessary third-party dependencies
Risk Level: Low

Vulnerable Code

text

requests>=2.25.1
openclaw>=2026.3.12

Technical Analysis

The dependency declarations specify only minimum versions and do not use exact versions, upper bounds, hashes, or a reviewed lockfile. Consequently, future installations can resolve to package releases that were not present during this audit.

The implementation imports requests, but it does not import openclaw. The project documentation also states that only requests is required while its integration example refers to a differently named openclaw2 module. This inconsistency introduces an unnecessary package into the installation process and increases the number of third-party components trusted by the project.

Python packages may execute build or installation logic during dependency installation. Mutable dependency resolution therefore expands the supply-chain attack surface if a future resolved release or transitive dependency becomes compromised. The audit did not establish that the currently named packages are malicious; the finding concerns avoidable and insufficiently reproducible dependency trust.

Attack Path

1. A user creates an environment and installs requirements.txt.
2. The package manager resolves versions newer than the stated lower bounds because no exact versions or hashes are provided.
3. It also installs openclaw, even though the audited implementation does not use it.
4. If a future release or transitive dependency is compromised, malicious build or installation code may execute during installation.
5. Such code executes with the privileges of the user or service account performing the installation.

Impact Assessment

Successful exploitation depends on compromise or unsafe resolution of a dependency and is ther ...[truncated 409 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove openclaw from requirements.txt unless the runtime implementation actually requires it.
2. Reconcile the documented openclaw2 example with the intended package and import name.
3. Pin dependencies to reviewed versions through a reproducible lockfile.
4. Use package hashes, such as pip's --require-hashes workflow, to verify downloaded artifacts.
5. Review and pin transitive dependencies where the deployment model requires deterministic builds.
6. Use a trusted package index and prevent unintended fallback to untrusted or internal-conflicting package sources.
7. Run dependency installation with minimum privileges inside an isolated build environment.
8. Add automated dependency vulnerability and provenance checks to CI.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to execute Python code and use the requests-based plugin to access external exchange endpoints, but the manifest declares no explicit tool scope or network permission boundaries. This creates a permission mismatch: an orchestrator or reviewer cannot tell from the skill metadata that network access is required, reducing transparency and making unintended outbound requests easier to approve or overlook.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The SZSE request uses plain HTTP for a network call that includes user-influenced query content such as stock codes, keywords, and date ranges. Because the request is unencrypted, intermediaries can observe or modify the traffic, which creates confidentiality and integrity risks even if the data is not highly sensitive.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · stock_plugin.py (reported line 82)May include surrounding context.

python

if keyword: payload["searchKey"] = [keyword]

        try:
            resp = requests.post(url, headers=headers, json=payload, timeout=10)
            if resp.status_code == 200:
                data = resp.json()
                results = []

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The SSE query sends user-supplied search data, including keyword and stock identifiers, to an external service and does so over plain HTTP. This exposes user queries to passive monitoring and active tampering, and the returned announcement links are also constructed with HTTP, compounding the integrity risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specification uses a lower-bound version constraint instead of pinning an exact version, which makes builds non-reproducible and can cause different environments to resolve to different releases. For a security-sensitive tool that queries external market data, this increases supply-chain uncertainty and makes it harder to verify whether known fixes or regressions are present.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.25.1
openclaw>=2026.3.12

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest references requests without an exact version even though multiple known advisories exist for some releases, so it is impossible to determine from this file whether deployment will pull a vulnerable version. In a network-facing skill that likely makes HTTP requests to exchange endpoints, using an affected requests release could expose the agent to credential leakage, TLS/verification flaws, or other client-side request handling issues depending on runtime resolution.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

openclaw>=2026.3.12 is also unpinned, allowing installation of any later release without review. This is a supply-chain risk because future versions may introduce insecure behavior, breaking changes, or malicious compromise, and the risk is somewhat elevated here because openclaw appears to be a less common package whose trust posture may be harder to independently assess.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.25.1
openclaw>=2026.3.12

Static analysis

No suspicious patterns detected.