IEX Cloud CLI

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:18 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent IEX Cloud helper that uses a disclosed API token to call trusted IEX endpoints, with one local token-exposure caveat users should understand.

Install only if you are comfortable giving the skill an IEX Cloud API token for market-data requests. Prefer OpenClaw SecretRefs or IEX_TOKEN over passing --token on the command line, because command-line arguments and the spawned curl invocation can expose the token to local process inspection or shell history.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/iex_cloud_cli.sh:224

Finding

IEX API Token Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/iex_cloud_cli.sh:108-111, scripts/iex_cloud_cli.sh:224-231
Vulnerability Type: API credential disclosure through process arguments
Risk Level: Medium

Vulnerable Code

bash

--token)
  [[ $# -ge 2 ]] || die "--token requires a value"
  TOKEN="$2"
  shift 2
  ;;

bash

curl_args=(
  --silent
  --show-error
  --fail-with-body
  --max-time "$TIMEOUT"
  --get
  "$URL"
  --data-urlencode "token=$TOKEN"
)

Technical Analysis

The CLI accepts an API token through the --token TOKEN command-line option. This exposes the token in the CLI process's command line and may also preserve it in shell history.

Regardless of whether the token originates from the command line or an environment variable, the script then embeds it in a curl argument:

bash

--data-urlencode "token=$TOKEN"

Consequently, the spawned curl process contains the plaintext credential in its argument vector. Depending on operating-system process visibility and monitoring configuration, the argument may be observable through process inspection interfaces or process-monitoring tools.

Although IEX Cloud requires query-parameter authentication, the token does not need to be passed from the script to curl as a visible command-line argument. This issue is limited to local credential exposure; the audited code restricts the network destination to the declared IEX API hosts.

Attack Path

1. A user executes the CLI with a valid IEX token, either through --token TOKEN or a supported environment variable.
2. If --token is used, the plaintext token appears in the original CLI command line and may be recorded in shell history.
3. The script constructs the curl_args array with token=$TOKEN.
4. The script launches curl, placing the plaintext token in the child process's argument vector.
5. A local user, privileged monitoring service, diagnostic collector, or other process with permission to inspect process ...[truncated 848 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove or deprecate the --token TOKEN option because it directly exposes credentials in command history and the CLI process command line.
2. Obtain tokens from an approved secret-management mechanism or a protected input channel. For interactive use, support silent input with read -r -s.
3. Avoid placing the token in the spawned curl argument vector. Supply sensitive curl configuration through protected standard input or a securely managed file descriptor, such as invoking curl --config - and sending the sensitive option through standard input.
4. If a temporary configuration file is unavoidable, create it with permissions restricted to the current user, prevent symbolic-link attacks, and delete it reliably with a shell trap.
5. Ensure tokens remain excluded from warnings, error messages, debugging traces, telemetry, and request logs.
6. Document that environment-variable injection through the platform's SecretRef mechanism is preferred, while noting that environment visibility should also be restricted through appropriate operating-system process controls.
7. Add an automated regression test that inspects the spawned curl command line and fails if the token appears in its argument vector.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code chunk does not implement the declared end-user capability of accessing IEX Cloud market data through REST API calls. Instead, it validates that metadata, docs, and a separate runtime script remain aligned with expected values, including env vars, trusted hosts, and documentation markers. While the checks are related to the IEX Cloud skill ecosystem, the primary behavior of this code is internal validation/QA, not market data retrieval or CLI interaction with the API. Therefore the supplied code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/validate_registry_metadata.py (reported line 103)May include surrounding context.

python

if credential.get("type") != "env_var":
        fail("primary_credential.type must be env_var")
    if credential.get("env_vars") != EXPECTED_REQUIRED_ENV_VARS:
        fail("primary_credential.env_vars must match required_env_vars")

    provenance = metadata.get("provenance", {})
    for field in ("owner", "repository", "remote"):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises shell-based operation and references executable scripts, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization/visibility gap: an agent or reviewer may not realize the skill needs shell and file-read capabilities, increasing the chance of overbroad execution in environments that rely on manifest-declared boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script sends the authentication token as a query parameter in the curl request, which is a network operation involving credentials. While the script validates hosts and documents the --token option, there is no explicit user-facing warning or disclosure here that the token will be transmitted to the remote API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.