eastmoney skills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:30 AM UTC
• Version: 1.0.2

Overview

This skill is not clearly malicious, but it asks users to install changing remote skill packages and delete local skill folders without adequate verification or safeguards.

Review this carefully before installing. Do not run the cleanup or download commands as written unless you have backups and trust the publisher-hosted ZIPs; prefer a signed or checksum-verified release, inspect the downloaded sub-skills before loading them, and enter MX_APIKEY only through a confidential secret-handling path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: skill.md:66
• Finding: Unverified Remote Skill Archives Are Installed into a Trusted Skill Directory<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 66-105 **Vulnerability Type**: Unverified remote dependency retrieval and archive extraction **Risk Level**: High ```bash MX_DATA_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E220260320DRQ9S9.zip" MX_DATA_TEMP_FILE= "/temp/mx_data.zip" MX_DATA_OUTPUT_PATH="~/.openclaw/skills/mx-skills/mx-data/" curl -fSL MX_DATA_DOWNLOAD_URL -o MX_DATA_TEMP_FILE || { echo "下载 mx_data.zip 失败"; exit 1; } unzip -o MX_DATA_TEMP_FILE -d MX_DATA_OUTPUT_PATH || { echo "解压 mx_data.zip 失败"; exit 1; } rm -f MX_DATA_TEMP_FILE # 下载 妙想资讯搜索skill MX_SEARCH_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E2202603204ELGGZ.zip" MX_SEARCH_TEMP_FILE="/temp/mx_search.zip" MX_SEARCH_OUTPUT_PATH="~/.openclaw/skills/mx-skills/mx-search/" curl -fSL MX_SEARCH_DOWNLOAD_URL -o MX_SEARCH_TEMP_FILE || { echo "下载 mx_search.zip 失败"; exit 1; } unzip -o MX_SEARCH_TEMP_FILE -d MX_SEARCH_OUTPUT_PATH || { echo "解压 mx_search.zip 失败"; exit 1; } rm -f MX_SEARCH_TEMP_FILE # 下载 妙想智能选股skill MX_SELECT_STOCK_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E1202603204ETIIS.zip" MX_SELECT_STOCK_TEMP_FILE="/temp/mx_select_stock.zip" MX_SELECT_STOCK_OUTPUT_PATH="~/.openclaw/skills/mx-skills/mx-select-stock/" curl -fSL MX_SELECT_STOCK_DOWNLOAD_URL -o MX_SELECT_STOCK_TEMP_FILE || { echo "下载 mx_select_stock.zip 失败"; exit 1; } unzip -o MX_SELECT_STOCK_TEMP_FILE -d MX_SELECT_STOCK_OUTPUT_PATH || { echo "解压 mx_select_stock.zip 失败"; exit 1; } rm -f MX_SELECT_STOCK_TEMP_FILE # 下载 妙想自选股管理skill MX_SELFSELECT_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E220260320556PGW.zip" MX_SELFSELECT_TEMP_FILE="/temp/mx_selfselect.zip" MX_SELFSELECT_OUTPUT_PATH="~/.openclaw/skills/mx-skills/mx-selfselect/" curl -fSL MX_SELFSELECT_DOWNLOAD_URL -o MX_SELFSELECT_TEMP_FILE || { echo "下载 mx_selfselect.zip 失败"; exit 1; } unzip -o MX_SELFSELECT_TEMP_FILE -d MX_SELFSELECT_OUTPUT_PATH || { echo "解压 mx_selfselect.zip 失败"; exit 1; } rm -f MX_SELFS ...[truncated 3082 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish immutable, versioned artifacts rather than mutable or opaque download references. 2. Provide a trusted manifest containing a SHA-256 or stronger digest for every ZIP. 3. Verify each digest before extraction and terminate installation on any mismatch. 4. Digitally sign the manifest or artifacts and verify signatures against a pinned publisher key. 5. Download to a private directory created with `mktemp -d`, with permissions restricted to the current user. 6. List and validate archive entries before extraction. Reject absolute paths, `..` traversal components, device files, and symbolic or hard links. 7. Extract into a staging directory, validate the expected file set, and atomically move the verified result into the Skill directory. 8. Correct all shell variable expansions and path handling, including using `"${VARIABLE}"` and `"${HOME}/..."`. 9. Review the contents of every downloaded Skill package independently before allowing OpenClaw to load it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:56
• Finding: Destructive Wildcard Deletion Can Remove Unrelated Skills<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, line 56 **Vulnerability Type**: Unscoped recursive deletion **Risk Level**: Medium ```bash rm -rf ~/.openclaw/skills/mx-skills* ``` ### Technical Analysis The cleanup command recursively and forcibly removes every entry in `~/.openclaw/skills` whose name begins with `mx-skills`. It does not verify a canonical target path, restrict deletion to one exact installation directory, display the matched paths, request confirmation, or create a backup. The wildcard therefore expands beyond the intended `mx-skills` directory. For example, directories named `mx-skills-backup` or `mx-skills-custom` are also deletion targets. Because `rm -rf` suppresses normal safeguards and recursively removes content, executing this instruction can cause irreversible data loss. ### Attack Path 1. A user has an unrelated Skill, customization, or backup under a directory whose name begins with `mx-skills`. 2. The user follows the documented cleanup step. 3. The shell expands `mx-skills*` to all matching paths. 4. `rm -rf` recursively deletes every match without confirmation. 5. Unrelated Skill definitions, custom scripts, configuration, or backups are lost. ### Impact Assessment The impact is unauthorized destruction of files writable by the current user and matching the documented prefix. The direct scope is the matching content under the user's OpenClaw Skill directory. The command does not itself grant additional privileges and cannot delete files that the invoking account is not permitted to remove, but it can permanently destroy local Skill customizations and backups owned by that account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove only the exact expected directory: ```bash target="${HOME}/.openclaw/skills/mx-skills" ``` 2. Resolve and validate the canonical path before deletion, ensuring it equals the intended location and is not empty, `/`, `$HOME`, or the parent Skill directory. 3. Display the exact target and request explicit confirmation before destructive removal. 4. Prefer renaming the existing installation to a timestamped backup and deleting it only after successful installation verification. 5. Avoid wildcard deletion entirely. 6. Use defensive shell settings and quoted variables: ```bash set -eu rm -rf -- "$target" ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:116
• Finding: Defective and Non-Confidential API Key Input Handling<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 116-120 **Vulnerability Type**: Unsafe credential handling and malformed shell variable expansion **Risk Level**: Medium ```bash if [ -z " $ MX_APIKEY" ]; then echo "⚠️ 未检测到环境变量 MX_APIKEY。" read -p "请输入您的 API Key: " input_key if [ -n " $ input_key" ]; then export MX_APIKEY=" $ input_key" ``` ### Technical Analysis Whitespace separates the dollar sign from the intended shell variable names. Inside the quoted strings, `$ MX_APIKEY` and `$ input_key` do not expand the variables; they are treated as nonempty literal text. Therefore: - The initial `-z` test normally evaluates as false, so a missing API key is not detected. - The input validation does not actually validate `input_key`. - The exported value does not correctly contain the user's entered key. - `read -p` does not use silent mode, so the API key is echoed visibly to the terminal while entered if that branch is reached after correction or modification. This combines a functional authentication failure with unsafe secret-entry guidance. The snippet does not persist the key to a startup file, which limits persistence, but visible terminal entry can expose the key to observers or terminal recording systems. ### Attack Path 1. A user runs the documented credential setup. 2. The malformed test fails to detect that `MX_APIKEY` is absent, causing installation or subsequent API authentication to proceed without a valid key. 3. During troubleshooting, the user corrects or bypasses the condition and reaches the provided `read -p` command. 4. The API key is displayed during entry and may be observed by a nearby person, screen-sharing participant, terminal recorder, or captured session log. 5. A party that obtains the key can use it against the associated API subject to the permissions and limits assigned to that credential. ### Impact Assessment As written, the primary impact is denial of functionality because the API key is no ...[truncated 481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use safe parameter expansion when testing the environment: ```bash if [ -z "${MX_APIKEY:-}" ]; then ``` 2. Read the secret without terminal echo and preserve its exact contents: ```bash printf 'Enter your API key: ' >&2 IFS= read -r -s input_key printf '\n' >&2 ``` 3. Validate the actual input and export it without introducing whitespace: ```bash if [ -n "$input_key" ]; then export MX_APIKEY="$input_key" else echo "API key input was empty." >&2 exit 1 fi ``` 4. Avoid printing the key in logs, command output, diagnostics, or verification steps. 5. Clear temporary shell variables after exporting where practical: ```bash unset input_key ``` 6. Prefer a protected credential manager or secret store when persistent storage is required, and document the minimum API permissions the key should have. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

安装前，请先删除`~/.openclaw/skills`目录下任何以`mx-skills`开头的现有技能目录，以避免版本冲突：

```bash
rm -rf ~/.openclaw/skills/mx-skills*
```

### 2. 下载妙想Skill

• Confidence: 96% confidence
• Finding: `rm -rf ~/.openclaw/skills/mx-skills*` is a genuinely hazardous parameter pattern because it performs recursive deletion on a glob-expanded path in persistent user storage. In the context of a financial skill package, there is no strong justification for such an aggressive cleanup step, making the instruction disproportionately dangerous.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

安装前，请先删除`~/.openclaw/skills`目录下任何以`mx-skills`开头的现有技能目录，以避免版本冲突：

```bash
rm -rf ~/.openclaw/skills/mx-skills*
```

### 2. 下载妙想Skill

• Confidence: 96% confidence
• Finding: `rm -rf ~/.openclaw/skills/mx-skills*` is a genuinely hazardous parameter pattern because it performs recursive deletion on a glob-expanded path in persistent user storage. In the context of a financial skill package, there is no strong justification for such an aggressive cleanup step, making the instruction disproportionately dangerous.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file claims to describe a financial skill collection, but actually behaves like an installer by deleting directories and replacing local content. That is dangerous because users or agents may treat it as harmless metadata/documentation while it contains operational instructions that modify the local environment.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The file claims to describe a financial skill collection, but actually behaves like an installer by deleting directories and replacing local content. That is dangerous because users or agents may treat it as harmless metadata/documentation while it contains operational instructions that modify the local environment.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill documentation includes package-installer behavior—deletion, remote archive download, unzip, and persistence into the user's skill directory—that is not necessary for a financial query skill's runtime purpose. This expands the attack surface to supply-chain compromise, path misuse, and accidental destructive changes on the host.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documented `rm -rf ~/.openclaw/skills/mx-skills*` deletes persistent local content without confirmation, backup guidance, or safety checks. Wildcard-based recursive deletion is especially risky because path expansion mistakes or user misunderstanding can cause unintended data loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions tell users to download and unzip multiple remote archives into persistent directories without any safety warning, signature check, or checksum verification. If the remote host, transport, or referenced artifacts are compromised, this can lead to silent installation of malicious skill content.

Session Persistence

Medium

• Category: Rogue Agent

Content

从云端下载最新的`mx-skills`skill 定义，保持所有文件在同一目录下：

```bash
mkdir -p ~/.openclaw/skills/mx-skills/scripts
# 下载 妙想金融数据skill
MX_DATA_DOWNLOAD_URL="https://marketdfs.dfcfw.com/file/download/E220260320DRQ9S9.zip"
MX_DATA_TEMP_FILE= "/temp/mx_data.zip"

• Confidence: 87% confidence
• Finding: The installer persists downloaded content under `~/.openclaw/skills/mx-skills`, creating long-lived local state that can continue affecting future sessions. Because the content comes from remote archives without integrity verification, this persistence increases the blast radius of any compromise or mistaken installation.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

所有这些Skill文件在复制后都应存在：

```bash
test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"
echo "MX_APIKEY=${MX_APIKEY:+is set}"

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

test -f ~/.openclaw/skills/mx-skills/mx-data/SKILL.md && echo "mx_data.md OK" || echo "mx_data.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"
echo "MX_APIKEY=${MX_APIKEY:+is set}"
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

test -f ~/.openclaw/skills/mx-skills/mx-search/SKILL.md && echo "mx_search.md OK" || echo "mx_search.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-select-stock/SKILL.md && echo "mx_select_stock.md OK" || echo "mx_select_stock.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-selfselect/SKILL.md && echo "mx_selfselect.md OK" || echo "mx_selfselect.md MISSING"
test -f ~/.openclaw/skills/mx-skills/mx-stock-simulator/SKILL.md && echo "mx_stock_simulator.md OK" || echo "mx_stock_simulator.md MISSING"
echo "MX_APIKEY=${MX_APIKEY:+is set}"
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The manifest and installation guidance are presented in Chinese, but the file does not indicate that the skill is region-specific or offer an alternative language or user opt-in. This can violate a language/locale policy when documentation forces a specific language by default.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: skill.md:56