T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:66- Finding
Unverified Remote Payloads Are Installed into the Active Agent Skill Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
eastmoney skills
Security checks for vulnerabilities and agentic risk
Overview
This finance skill is not proven malicious, but its install guide downloads unverified remote skill packages and can delete matching local skill folders.
Review the install steps before installing. Do not run the wildcard delete as written, and do not install the remote ZIPs unless you trust the publisher and can verify the exact archive contents or hashes. Be aware the skill uses an MX_APIKEY and includes features that can change watchlists or simulated portfolio records.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:52- Finding
Wildcard Recursive Deletion Can Remove Unrelated Skill Data
- Content
View full analysis
- Remediation
View remediation
&2; exit 1 ;; esac if [ -d "$skill_root" ]; then mv -- "$skill_root" "${skill_root}.backup" fi ``` 2. Do not combine wildcards with `rm -rf`. 3. Verify an installation manifest or ownership marker before replacing an existing directory. 4. Stage the new installation and use an atomic rename only after validation succeeds. 5. Keep a rollback copy until the new installation has been verified. 6. If deletion is necessary, use `rm -rf -- "$validated_exact_path"` only after confirming the path is nonempty, canonicalized, and located beneath the expected skill root. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:66- Finding
Malformed Shell Variable Handling Causes Unpredictable and Insecure Installation Behavior
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi export MX_APIKEY="$input_key" fi ``` 5. Avoid logging or printing the API key. 6. Use `$HOME` rather than a quoted tilde in constructed paths. 7. Apply the same corrections consistently to all five download blocks. 8. Validate the complete installation before reporting success, and roll back partial changes on failure. ]]>
Vulnerability Patterns
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The command
rm -rf ~/.openclaw/skills/mx-skills*uses recursive forced deletion with a wildcard in a user home subdirectory. Wildcard-based destructive commands are dangerous because mistakes, path expansion issues, or unexpected matching directories can lead to irreversible loss of local data and make it easy for an attacker to smuggle harmful cleanup behavior into seemingly routine setup steps.- Content
安装前，请先删除
~/.openclaw/skills目录下任何以mx-skills开头的现有技能目录，以避免版本冲突：bash rm -rf ~/.openclaw/skills/mx-skills*2. 下载妙想Skill
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The command
rm -rf ~/.openclaw/skills/mx-skills*uses recursive forced deletion with a wildcard in a user home subdirectory. Wildcard-based destructive commands are dangerous because mistakes, path expansion issues, or unexpected matching directories can lead to irreversible loss of local data and make it easy for an attacker to smuggle harmful cleanup behavior into seemingly routine setup steps.- Content
安装前，请先删除
~/.openclaw/skills目录下任何以mx-skills开头的现有技能目录，以避免版本冲突：bash rm -rf ~/.openclaw/skills/mx-skills*2. 下载妙想Skill
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is presented as a financial capability set, but its instructions also direct users to delete local directories before installation. This expands the operational scope from data access to local system modification, creating a mismatch that can mislead users into executing filesystem-changing commands they would not expect from a finance skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented cleanup step uses a recursive force-delete command without a prominent warning about data loss or a preview of what will be removed. Users may irreversibly delete existing local skill directories or unintended matches if they run the command blindly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file instructs users to download multiple remote ZIP archives and unpack them into persistent local directories, but this behavior is not reflected in the skill description. Hidden code/artifact retrieval is dangerous because it introduces supply-chain risk and can silently install unreviewed content on the user's machine.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The installation commands extract ZIP files with overwrite enabled into persistent directories, but the instructions do not warn that existing files may be replaced. This can clobber local content and make it harder for users to detect tampering or accidental version conflicts.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The installation creates and populates a persistent directory under the user's home directory, causing long-lived modification of the local agent environment. In the context of a skill that advertises financial data functions rather than system installation behavior, this persistence increases risk because downloaded artifacts remain available for future execution or abuse.
- Content
从云端下载最新的
mx-skillsskill 定义，保持所有文件在同一目录下：bash mkdir -p ~/.openclaw/skills/mx-skills/scripts # 下载 妙想金融数据skill MX_DATA_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E220260320DRQ9S9.zip" MX_DATA_TEMP_FILE= "/temp/mx_data.zip"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
所有这些Skill文件在复制后都应存在：
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
text
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
text
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- skill.md:56