ClawHub
Back to skill

Security audit

eastmoney skills

Security checks for vulnerabilities and agentic risk

Overview

This skill fits a simulated stock-trading purpose, but it needs Review because it can submit or cancel simulated trades and send the API key to a configurable URL without enough safeguards.

Install only if you trust the 妙想 API key and environment configuration. Keep MX_API_URL set to the documented HTTPS service, use a limited or revocable API key if possible, and do not let the agent run buy, sell, or cancel requests unless you have clearly confirmed the exact action. Be aware that account and order responses are saved locally as raw JSON in the OpenClaw workspace.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mx_stock_simulator.py:50
Finding

Configurable API destination can expose the API key and account requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mx_stock_simulator.py:30
Finding

Sensitive account and transaction responses are stored without explicit access restrictions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Third-party dependency is installed without a version or integrity constraint

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Tainted flow: 'url' from os.environ.get (line 54, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The request destination is built from the MX_API_URL environment variable and used directly in requests.post while sending the apikey header and trading/account payloads. If an attacker can influence the runtime environment, they can redirect sensitive requests to an attacker-controlled host, exfiltrating credentials and financial data and potentially capturing trade instructions.

Content

Scanner excerpt · scripts/mx_stock_simulator.py (reported line 61)May include surrounding context.

python
}
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Buy, sell, and cancel operations are executed immediately from parsed natural-language input with no confirmation step, dry-run preview, or secondary approval. In an agent setting, ambiguous phrasing, prompt injection, or accidental invocation can therefore trigger destructive financial actions and mass cancellation of orders.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill declares capabilities that involve environment access, outbound network requests, and file output, but it does not constrain them with explicit tool scope such as permissions or allowed-tools. In a trading-oriented skill, that omission is dangerous because an agent could access secrets, transmit them to a remote endpoint, and write sensitive account data to disk without clear sandbox limits or user-visible restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill enables buy, sell, and especially one-click cancel operations, but it does not present an explicit warning or confirmation requirement for destructive account actions. In a financial-trading context, even a simulator can cause account state changes, strategy disruption, or unintended mass cancellation if an agent misinterprets a user request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

  • 成功响应：{ }
bash
curl -X POST "${MX_API_URL}/api/claw/mockTrading/positions" \
  -H "apikey: ${MX_APIKEY}" \
  -H "Content-Type: application/json" \
  -d '{}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This request sends trade instructions to an external API and can cause state-changing buy or sell operations. In the absence of stronger guardrails like confirmation, domain allowlisting, and action scoping, an agent could execute unauthorized or mistaken trades using the user's API key.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

  • 委托价格说明：当 useMarketPrice=false 时，price参数必填，且需符合市场规则：沪市价格小数位不超过2位，深市价格小数位不超过3位；当 useMarketPrice=true 时，price参数会被忽略，系统会自动以行情最新价进行买入。
bash
curl -X POST "${MX_API_URL}/api/claw/mockTrading/trade" \
  -H "apikey: ${MX_APIKEY}" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This request can cancel one order or all pending orders through an external API, making it a destructive state-changing action. In a trading workflow, mass cancellation without strong confirmation and scoping is risky because a prompt misunderstanding could disrupt the user's active strategy or erase pending execution opportunities.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

  • 股票代码格式说明：仅支持A股，格式为6位数字，例如 600519、000001，系统会自动识别并补全市场号；另外股票代码在type为order时必传。
bash
curl -X POST "${MX_API_URL}/api/claw/mockTrading/cancel" \
  -H "apikey: ${MX_APIKEY}" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

| fltOrderStatus | 否 | 0=全部（默认），2=已报，4=已成 等 |

bash
curl -X POST "${MX_API_URL}/api/claw/mockTrading/orders" \
  -H "apikey: ${MX_APIKEY}" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

User-facing docstrings, prompts, and output messages are entirely in Chinese, and the skill does not indicate that Chinese is optional or required for a region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script persistently writes account balances, holdings, orders, and trade results to /root/.openclaw/workspace/mx_data/output without user notice or consent. These files may contain sensitive financial data and, in shared or multi-tenant environments, could be exposed to other processes, backups, or later compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx_stock_simulator.py (reported line 61)May include surrounding context.

python
}
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and module docstring state that the skill supports 历史成交查询, which implies querying completed trade history. However, the intent parser maps phrases like '成交记录' and '历史成交' to the 'orders' intent, and the main handler only calls /api/claw/mockTrading/orders, which is presented as 委托查询 rather than a historical fills endpoint. This is a semantic mismatch between the advertised capability and implemented behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency file specifies requests without a version constraint, which makes builds non-reproducible and can cause deployment of unexpectedly vulnerable or breaking releases. In a stock trading simulator that performs authenticated API operations, dependency drift in a core HTTP client increases the chance of exposure to known or future transport, redirect, credential-handling, or verification issues.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Because requests is unpinned, it is impossible to verify whether the installed version includes fixes for its many published security advisories. This is especially concerning in a skill that interacts with trading APIs and may handle credentials, account data, and transaction requests, where a vulnerable HTTP library could contribute to credential leakage, TLS/verification issues, or unsafe request handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.