ClawHub
Back to skill

Security audit

FinXData

Security checks for vulnerabilities and agentic risk

Overview

FinXData provides clearly documented data queries without unrelated local access or persistent background activity.

FinXData receives your query parameters, IP address, and agent-type identifier. Account queries also send your configured API key and may consume quota. Prefer key-free queries when sufficient, keep the key private, and check returned data dates and coverage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding

代码片段明确展示的是 memory 快照读取与刷新，而不是声明中的行情、公告、财务、宏观等查询。片段也没有说明该快照与所声明数据的关系，因此存在功能不匹配。API Key 配置和缓存刷新本身属于实现细节，不单独构成不匹配；由于未提供脚本实现，不能进一步断定快照内容、访问位置或是否涉及敏感数据。

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/finxdata.py (reported line 762)May include surrounding context.

python
def command_data(args: argparse.Namespace) -> None:
    spec = ENDPOINTS[(args.group, args.action)]
    params = {
        name: getattr(args, name) for name, _required, _default in spec["parameters"]
    }
    is_agent = (args.group, args.action) in AGENT_ENDPOINTS
    agent_type = None