ClawHub
Back to skill

Security audit

eastmoney skills

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently provides stock-screening results through a disclosed external API, with privacy and CSV-opening cautions users should understand.

Install only if you are comfortable sending stock-screening queries and the MX_APIKEY credential to the documented 东方财富 endpoint. Do not include sensitive personal or proprietary strategy details in queries, and open generated CSV files with spreadsheet formula protections enabled or inspect them as plain text first.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
mx_select_stock.py:108
Finding

Spreadsheet Formula Injection in Generated CSV Files

Content
View full analysis
Remediation
View remediation
str: if value is None: return "" if isinstance(value, (dict, list)): text = json.dumps(value, ensure_ascii=False) else: text = str(value) candidate = text.lstrip(" ") if candidate.startswith(DANGEROUS_CSV_PREFIXES): return "'" + text return text ``` Sanitize both headers and values before writing: ```python safe_fieldnames = [neutralize_csv_cell(name) for name in fieldnames] with open(csv_path, "w", newline="", encoding="utf-8-sig") as f: writer = csv.DictWriter( f, fieldnames=safe_fieldnames, extrasaction="ignore", ) writer.writeheader() for row in rows: safe_row = { neutralize_csv_cell(key): neutralize_csv_cell(value) for key, value in row.items() } writer.writerow(safe_row) ``` Becau ...[truncated 174 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

  • 凭据保护: API Key 仅通过环境变量 MX_APIKEY 在服务端或受信任的运行环境中使用，不会在前端明文暴露。
javascript
curl -X POST --location 'https://mkapi2.dfcfs.com/finskillshub/api/claw/stock-screen' \
--header 'Content-Type: application/json' \
--header 'apikey: YOUR_API_KEY' \
--data '{"keyword": "今日涨幅2%的股票", "pageNo": 1, "pageSize": 20}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code performs an outbound network request to an external domain using user-provided query content and an API key from the environment. External transmission is expected for this skill's functionality, but in a security review it is still a real issue because there is no trust boundary warning, no host allowlisting beyond the hardcoded URL, and no controls to prevent sensitive user input from being exfiltrated to the remote provider.

Content

Scanner excerpt · mx_select_stock.py (reported line 149)May include surrounding context.

python
"keyword": query
        }
        
        response = requests.post(self.BASE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill sends both the user's free-form stock-screening query and the API key to a third-party external service, but the code provides no explicit user-facing notice or consent step before transmission. In an agent/skill context, users may unknowingly include sensitive investment intent, proprietary strategies, or other confidential text in the query, creating a privacy and data-handling risk even though the transport uses HTTPS.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.