ClawHub
Back to skill

Security audit

eastmoney skills

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for Eastmoney watchlist management, but it can immediately change account-linked financial watchlist data from natural-language input without confirmation.

Review before installing if you use this with a real Eastmoney account. Only run add/delete commands when you intend to change your watchlist, prefer setting MX_APIKEY through a trusted environment rather than a .env file, and treat generated CSV/raw JSON files as account-related data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mx_self_select.py:154
Finding

Spreadsheet Formula Injection in Exported CSV Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Unbounded and Unlocked Third-Party Dependency

Content
View full analysis
=2.31.0 ``` ### Technical Analysis The dependency declaration permits any future version of `requests` at or above version 2.31.0 and does not specify package hashes. Consequently, installations performed at different times may resolve to different, unaudited package versions and transitive dependency sets. No malicious package or currently vulnerable resolved version was identified in the reviewed project. The risk arises from the lack of reproducibility and integrity locking: a future compromised, defective, or incompatible release satisfying this constraint could be selected automatically. ### Attack Path 1. A future version of `requests`, or one of its transitive dependencies, is compromised or contains an exploitable defect. 2. That version remains compatible with the broad `>=2.31.0` constraint. 3. A user installs the project dependencies without a lock file or hash verification. 4. The package installer resolves and downloads the affected version. 5. Malicious installation behavior, import-time code, or vulnerable runtime functionality executes in the context of the user installing or running the Skill. This path depends on a future upstream or package-distribution compromise; the audited repository does not itself contain evidence of such a compromise. ### Impact Assessment Potential impact is bounded by the privileges of the account that installs or runs the dependency. In a compromised supply-chain scenario, this could include access to the Skill process's files, environment variables such as `MX_APIKEY`, outbound network access, and modification of files writable by that account. The broad constraint alone does not provide elevated privileges or establish that exploitation is currently possible. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tainted flow: 'headers' from os.environ.get (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 62)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Tainted flow: 'headers' from os.environ.get (line 71, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 81)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

Falling back to reading a plaintext .env file for an API key increases the risk of credential exposure through accidental commits, weak filesystem permissions, shared workspaces, or container/image leakage. While common in development, it is a credential-handling weakness in a skill that accesses a user account and performs remote actions on that account.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 33)May include surrounding context.

python
apikey = os.environ.get("MX_APIKEY", "")
    if not apikey:
        # 尝试从.env文件读取
        env_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_file):
            try:
                with open(env_file, "r") as f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises capabilities that involve environment-variable access, file output, and external network requests, but it does not declare any explicit tool scope or permissions boundary. This weakens reviewability and least-privilege enforcement, increasing the chance that an agent runtime grants broader access than users expect when handling account-linked watchlist data and API credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description and usage instructions are entirely in Chinese and explicitly describe operation through natural-language queries, but they do not state that the skill is Chinese-only or offer any language choice. This can violate a language/locale policy when users are not given opt-in or an alternative locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill transmits user commands and an API credential to a remote service but does not provide an explicit user-facing notice at execution time that data will leave the local environment. In a tool/agent context, this can create privacy and consent issues because natural-language inputs may contain more information than the user realizes will be sent upstream.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 62)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx_self_select.py (reported line 81)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill performs state-changing add/delete watchlist operations immediately based on CLI input or natural-language text, without confirmation, dry-run, or explicit acknowledgement. In an agent setting, ambiguous prompts, prompt injection in upstream context, or user misunderstanding could cause unintended portfolio/watchlist modifications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

SKILL.md 在配置与前置要求中多次声明应使用环境变量 MX_APIKEY，但安全注意事项又写成 EASTMONEY_APIKEY。这会让技能声明的使用方式与文档中的安全说明发生直接冲突，属于文档意图层面的矛盾。

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency is specified as requests>=2.31.0 without an upper bound or exact pin, which makes builds non-reproducible and can silently introduce vulnerable or incompatible versions over time. In a skill that interacts with account-backed data and external services, dependency drift increases supply-chain risk and makes security posture unverifiable.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Because requests is not pinned, it is impossible to verify whether the installed version includes fixes for known advisories affecting that package. This uncertainty is especially relevant here because the skill appears to access account and market data, so any vulnerable HTTP client behavior could affect credential handling, request integrity, or data exposure depending on the runtime version resolved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.