T08 · Insecure Dependencies
Error
- Location
skill.md:66- Finding
Unverified Remote Skill Archives Are Installed into a Trusted Skill Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
eastmoney skills
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it asks users to install changing remote skill packages and delete local skill folders without adequate verification or safeguards.
Review this carefully before installing. Do not run the cleanup or download commands as written unless you have backups and trust the publisher-hosted ZIPs; prefer a signed or checksum-verified release, inspect the downloaded sub-skills before loading them, and enter MX_APIKEY only through a confidential secret-handling path.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:56- Finding
Destructive Wildcard Deletion Can Remove Unrelated Skills
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:116- Finding
Defective and Non-Confidential API Key Input Handling
- Content
View full analysis
- Remediation
View remediation
&2 IFS= read -r -s input_key printf '\n' >&2 ``` 3. Validate the actual input and export it without introducing whitespace: ```bash if [ -n "$input_key" ]; then export MX_APIKEY="$input_key" else echo "API key input was empty." >&2 exit 1 fi ``` 4. Avoid printing the key in logs, command output, diagnostics, or verification steps. 5. Clear temporary shell variables after exporting where practical: ```bash unset input_key ``` 6. Prefer a protected credential manager or secret store when persistent storage is required, and document the minimum API permissions the key should have. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
rm -rf ~/.openclaw/skills/mx-skills*is a genuinely hazardous parameter pattern because it performs recursive deletion on a glob-expanded path in persistent user storage. In the context of a financial skill package, there is no strong justification for such an aggressive cleanup step, making the instruction disproportionately dangerous.- Content
安装前，请先删除
~/.openclaw/skills目录下任何以mx-skills开头的现有技能目录，以避免版本冲突：bash rm -rf ~/.openclaw/skills/mx-skills*2. 下载妙想Skill
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
rm -rf ~/.openclaw/skills/mx-skills*is a genuinely hazardous parameter pattern because it performs recursive deletion on a glob-expanded path in persistent user storage. In the context of a financial skill package, there is no strong justification for such an aggressive cleanup step, making the instruction disproportionately dangerous.- Content
安装前，请先删除
~/.openclaw/skills目录下任何以mx-skills开头的现有技能目录，以避免版本冲突：bash rm -rf ~/.openclaw/skills/mx-skills*2. 下载妙想Skill
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file claims to describe a financial skill collection, but actually behaves like an installer by deleting directories and replacing local content. That is dangerous because users or agents may treat it as harmless metadata/documentation while it contains operational instructions that modify the local environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file claims to describe a financial skill collection, but actually behaves like an installer by deleting directories and replacing local content. That is dangerous because users or agents may treat it as harmless metadata/documentation while it contains operational instructions that modify the local environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation includes package-installer behavior—deletion, remote archive download, unzip, and persistence into the user's skill directory—that is not necessary for a financial query skill's runtime purpose. This expands the attack surface to supply-chain compromise, path misuse, and accidental destructive changes on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented
rm -rf ~/.openclaw/skills/mx-skills*deletes persistent local content without confirmation, backup guidance, or safety checks. Wildcard-based recursive deletion is especially risky because path expansion mistakes or user misunderstanding can cause unintended data loss.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions tell users to download and unzip multiple remote archives into persistent directories without any safety warning, signature check, or checksum verification. If the remote host, transport, or referenced artifacts are compromised, this can lead to silent installation of malicious skill content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The installer persists downloaded content under
~/.openclaw/skills/mx-skills, creating long-lived local state that can continue affecting future sessions. Because the content comes from remote archives without integrity verification, this persistence increases the blast radius of any compromise or mistaken installation.- Content
从云端下载最新的
mx-skillsskill 定义，保持所有文件在同一目录下：bash mkdir -p ~/.openclaw/skills/mx-skills/scripts # 下载 妙想金融数据skill MX_DATA_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E220260320DRQ9S9.zip" MX_DATA_TEMP_FILE= "/temp/mx_data.zip"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
所有这些Skill文件在复制后都应存在：
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
text
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING" test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING" echo "MX_APIKEY=${MX_APIKEY:+is set}"
text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest and installation guidance are presented in Chinese, but the file does not indicate that the skill is region-specific or offer an alternative language or user opt-in. This can violate a language/locale policy when documentation forces a specific language by default.
- Content
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- skill.md:56