ClawHub
Back to skill

Security audit

eastmoney skills

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently provides disclosed financial news search using an API key, with expected network calls and local result files, but users should avoid sensitive queries and untrusted output folders.

Install only if you are comfortable sending financial search queries to the documented Eastmoney API using MX_APIKEY. Avoid putting confidential client data or proprietary trading intent in queries, store outputs in a private trusted directory, and do not run it with elevated privileges or shared writable output paths.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
mx_search.py:168
Finding

Predictable output files permit symlink-based arbitrary file overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
mx_search.py:117
Finding

Untrusted API content is emitted to the terminal without control-sequence sanitization

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares capabilities that involve reading an API key from the environment, making outbound network requests, and writing results to disk, but it does not define any explicit tool scope or permission boundaries. This creates an overbroad execution model where an agent may use more privilege than users expect, increasing the risk of unintended data exposure or unsafe file/network behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill sends user-provided query text to an external third-party endpoint, which is a real data-transmission risk even though it is the intended function of the skill. In a financial context, queries may contain sensitive trading intent, internal research topics, or customer information, so transmitting them externally can leak confidential data if not clearly constrained and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

  • 凭据保护: API Key 仅通过环境变量 MX_APIKEY 在服务端或受信任的运行环境中使用，不会在前端明文暴露。
javascript
curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/news-search' \
--header 'Content-Type: application/json' \
--header 'apikey: YOUR_API_KEY' \
--data '{"query":"立讯精密的资讯"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mx_search.py (reported line 51)May include surrounding context.

python
"query": query
        }
        
        response = requests.post(self.BASE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code saves extracted content and full raw JSON responses to disk without any prior warning or consent mechanism. This is risky because financial search results can include sensitive queries, proprietary research topics, or metadata, and raw JSON may contain more information than what is displayed, increasing privacy and data-handling exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest describes a financial information search skill, but does not mention credential handling or environment access. Reading an API key from the environment is an additional capability; while common implementation-wise, it is not declared in the stated purpose and may matter for intent auditing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill persists both extracted text and raw JSON search results to local disk even though its stated purpose is search/retrieval. In a financial context, queries and returned content may contain sensitive research topics, user interests, or regulated information, so silent local persistence increases data exposure and retention risk beyond the expected capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.