ClawHub
Back to skill

Security audit

题材库分析师 (A-Share Theme Analyst)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate China A-share theme-analysis aid, but its mutable install guidance and unauthenticated quote source need user review before installation.

Install only if you are comfortable with a skill that queries public China-market data sources and may suggest installing extra tooling. Prefer pinned ClawHub and Python package versions, review any SkillHub or multi-search-engine install instructions before running them, and treat quote data from the HTTP Tencent endpoint as unverified.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
README.md:45
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: README.md:45, README.md:88, skill.md:168, api-reference.md:256, api-reference.md:294, api-reference.md:482
Vulnerability Type: Unpinned dependencies retrieved from third-party package registries
Risk Level: High

Vulnerable Code

bash
npx clawhub@latest install subject-library
bash
pip install akshare

The same unversioned AKShare installation instruction is repeated in the Skill documentation and fallback implementation guidance.

Technical Analysis

The installation command uses npx with the mutable @latest tag. This causes the package manager to download and execute whichever package release is designated as latest at execution time, rather than the version reviewed during this audit.

The AKShare installation instructions similarly omit an exact version, lockfile, package hash, or signature verification. Importing the resulting package executes its Python module initialization code, while package installation may also execute build-system logic.

Because the effective dependency contents can change independently of this repository, the reviewed Skill does not provide a reproducible or integrity-verified dependency chain.

Attack Path

  1. An attacker compromises the package publisher, registry account, package distribution infrastructure, or a transitive dependency.
  2. The attacker publishes a malicious release and makes it the current latest version, or introduces malicious code into an unpinned AKShare dependency release.
  3. A user follows the documented npx clawhub@latest or pip install akshare instruction.
  4. The package manager retrieves the malicious version because no reviewed version or integrity digest is required.
  5. Package installation, npx execution, or subsequent Python import runs attacker-controlled code.
  6. The malicious process operates with the permissions of the user running the agent or installation command.

Impact Assessment

Succ ...[truncated 605 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed version:
    bash
    npx clawhub@<reviewed-version> install subject-library
  2. Pin AKShare and all Python dependencies to exact versions in a lockfile or requirements file.
  3. Record and verify package integrity hashes, such as with pip's --require-hashes.
  4. Use package-lock or an equivalent npm lockfile with integrity metadata.
  5. Verify package publisher identity and obtain dependencies only from documented, trusted registries.
  6. Disable or review package lifecycle scripts where operationally possible.
  7. Run installation in a sandbox or least-privileged environment without access to secrets.
  8. Establish a dependency-update process in which new versions are reviewed and tested before their pins are changed.

T08 · Insecure Dependencies

Error
Location
skill.md:221
Finding

Mutable External Bootstrap Instructions for Additional Skills

Content
View full analysis

Vulnerability Details

File Location: skill.md:221-225, analysis-templates.md:622-625
Vulnerability Type: Unverified external installation source
Risk Level: High

Vulnerable Code

text
If no search tool is available, prompt the user to install multi-search-engine:
"Recommend installing a web-search skill to obtain current information.
Installation method: first install the SkillHub store
(https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/skillhub.md)
and then install the multi-search-engine skill."

The corresponding instruction in analysis-templates.md directs the user to the same mutable cloud-storage document before installing another Skill.

Technical Analysis

The Skill redirects users to an installation document hosted in an external cloud-storage object. That object is not included in this repository, has no pinned content digest, and cannot be validated against the code reviewed in this audit.

Although the project does not automatically execute the URL, the instruction establishes a bootstrap chain from trusted Skill guidance to mutable external content and then to installation of an additional Skill. Whoever controls the remote object can change the effective installation instructions after this repository has been reviewed.

This represents an unsafe supply-chain boundary because the identity and integrity of the subsequently installed components are not established by the audited project.

Attack Path

  1. An attacker compromises the cloud-storage account, modifies the referenced object, gains control over its delivery path, or otherwise causes altered content to be served.
  2. The agent determines that no supported web-search tool is available.
  3. Following the Skill instructions, the agent recommends the external installation URL to the user.
  4. The user trusts the recommendation and follows the modified remote instructions.
  5. The remote document directs the user to execute attacker-controlled ...[truncated 744 chars]
Remediation
View remediation

Remediation Suggestions

  1. Vendor the reviewed installation instructions into this repository.
  2. Reference a versioned, immutable release artifact rather than a mutable cloud-storage object.
  3. Publish and verify a cryptographic digest or digital signature for every external installation artifact.
  4. Identify the exact version and publisher of the multi-search-engine Skill.
  5. Require explicit, informed user approval before installing any additional Skill or dependency.
  6. Display the exact commands and destination files before execution.
  7. Avoid executing instructions obtained dynamically from remote Markdown.
  8. Install additional tooling in a sandbox with minimal filesystem, credential, and network access.
  9. Review every update to the external Skill before changing the pinned version or digest.

T09 · Insecure Skill Coding Practices

Warning
Location
api-reference.md:344
Finding

Stock Quote Retrieval over Unauthenticated Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: api-reference.md:344-346; the endpoint is also documented at README.md:81 and api-reference.md:271
Vulnerability Type: Plaintext network transport without response authenticity
Risk Level: Medium

Vulnerable Code

python
url = f'http://qt.gtimg.cn/q={",".join(batch)}'
try:
    resp = urllib.request.urlopen(url, timeout=10).read().decode('gbk')

Technical Analysis

The primary Tencent quote source uses HTTP rather than HTTPS. HTTP provides neither transport encryption nor server authentication. Any party able to observe or modify traffic between the agent and the endpoint can alter the response.

The parser treats fields from the plaintext response as authoritative values for stock names, prices, percentage changes, turnover, transaction amounts, and market capitalization. It does not authenticate the response or compare it with an independent secure source before using the values in financial analysis.

The stock codes in the request are public rather than sensitive. The principal risk is therefore integrity manipulation, not confidentiality loss.

Attack Path

  1. The Skill extracts stock codes from theme data.
  2. The quote helper sends those codes to http://qt.gtimg.cn.
  3. A network-positioned attacker, compromised proxy, malicious hotspot, or altered network gateway intercepts the request.
  4. The attacker returns a syntactically valid response containing fabricated quote fields.
  5. The parser accepts the altered response because it performs no authenticity or cross-source validation.
  6. The manipulated values are incorporated into market analysis and presented to the user as current quote data.

Impact Assessment

An attacker could falsify market prices, gains or losses, turnover, transaction values, and capitalization data used in generated reports. This could mislead users about theme strength, market activity, or apparent financial conditions.

This issue does not directly g ...[truncated 203 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the plaintext endpoint with an officially supported HTTPS endpoint.
  2. If Tencent does not provide a secure equivalent, do not use it as the primary source.
  3. Prefer the documented East Money HTTPS endpoint or another authenticated market-data provider.
  4. If plaintext retrieval is unavoidable, verify every result against an independent HTTPS source before presenting it.
  5. Reject data when providers differ beyond a narrowly defined tolerance.
  6. Record the source and retrieval time for each quote and clearly indicate unverified data.
  7. Apply strict response validation, including expected stock code, field count, numeric ranges, and freshness checks.
  8. Do not silently fall back to an unauthenticated transport for security-sensitive or decision-relevant data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file explicitly says the skill content is in Chinese, which imposes a language constraint on users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified locale constraint is clearly documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This line repeats that the skill content is in Chinese, but does not indicate that users may choose another language. Because the policy applies to all file types and covers language/locale restrictions, this is a reportable natural-language policy issue.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub@latest install subject-library, which pulls and executes the latest package version at install time without pinning to a reviewed release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad phrases like “题材列表” and “今天题材行情”, which could appear in ordinary market conversation without clearly indicating the user wants this specific template invoked. The file does not provide negative examples or tighter activation constraints to distinguish casual discussion from intentional skill use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Phrases such as “XX 概念怎么样” and “XX 板块详情” are generic user utterances that can arise in normal conversation, but the document does not specify boundaries for when this template should or should not be selected. Without constraints or negative examples, activation may be inconsistent or overly eager.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger examples “A 和 B 哪个好” and “对比 XX 和 YY” are broad comparison requests that lack domain and scope constraints. The file does not state whether both entities must be themes, nor does it give non-trigger examples, increasing the risk of accidental invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Triggers like “分析一下今天的主线” and “全面分析” are expansive and not tightly bounded to a specific invocation context. Because the file does not define what qualifies as a mainline or provide exclusions, the skill may activate for general analytical conversation rather than explicit use of this template.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · analysis-templates.md (reported line 715)May include surrounding context.

md
def get_full_list():
    """获取题材库全量列表，按 orderNumber 排序"""
    resp = requests.post(f"{BASE_URL}/teach-hotspot/subject/fullList",
                         json={}, headers=HEADERS)
    result = resp.json()
    if result["code"] != 20000:

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · analysis-templates.md (reported line 724)May include surrounding context.

md
def get_subject_detail(subject_id):
    """获取单个题材详情"""
    resp = requests.post(f"{BASE_URL}/teach-hotspot/subject/subjectDetail4Free",
                         json={"subjectId": subject_id}, headers=HEADERS)
    result = resp.json()
    if result["code"] == 50000:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 29)May include surrounding context.

调用示例

bash
curl -X POST 'https://group-api.itougu.com/teach-hotspot/subject/fullList' \
  -H 'Content-Type: application/json' \
  -d '{}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-reference.md (reported line 105)May include surrounding context.

调用示例

bash
curl -X POST 'https://group-api.itougu.com/teach-hotspot/subject/subjectDetail4Free' \
  -H 'Content-Type: application/json' \
  -d '{"subjectId": "90000797"}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation materially broadens the skill from querying the declared 题材库 service into orchestrating third-party market-data collection from Tencent, Eastmoney, and AKShare. That expansion increases the skill’s network reach, dependency surface, and data-flow complexity beyond the stated purpose, which can enable unreviewed external calls and make downstream behavior harder to constrain or audit.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 466)May include surrounding context.

bash
# 题材库列表
curl -X POST 'https://group-api.itougu.com/teach-hotspot/subject/fullList' \
  -H 'Content-Type: application/json' \
  -d '{}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents all instructions, triggers, and output templates exclusively in Chinese, which can amount to a language policy constraint when no user opt-in or alternative locale is offered. There is no indication that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown explicitly instructs readers to '始终使用 Python 获取行情' and repeats '始终用 Python', which imposes a specific implementation language rather than offering a choice. Under the policy rule, forcing a language without user opt-in is a natural-language policy violation unless the constraint is clearly justified as mandatory; here the text gives practical reasons, but still presents Python as an unconditional requirement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Instructing the agent to install and use AKShare introduces an additional executable dependency and transitive supply-chain risk that is not necessary for the core subject-library function. Even though AKShare is legitimate, adding package installation and fallback execution increases attack surface and operational unpredictability in environments that should remain tightly controlled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.