ClawHub
Back to skill

Security audit

Stock Daily Analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits stock analysis, but its install/update scripts can pull and run changing GitHub code and its AI integrations send analysis data to configurable external services.

Review the install and update scripts before running them, avoid running them with privileged accounts, pin the upstream repository and Python dependencies if you use them, and only configure AI providers or proxies if you are comfortable sending stock symbols and technical-analysis data to those services. Keep API keys out of shared directories and remove unmanaged .env backups.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
scripts/setup.sh:23
Finding
Mutable Remote Repository Is Retrieved and Subsequently Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:23-42`, `scripts/update.sh:24-31`, `scripts/run.sh:30` **Vulnerability Type**: Remote payload retrieval through an unpinned Git branch **Risk Level**: Medium ### Vulnerable Code From `scripts/setup.sh:23-42`: ```bash # Clone or update the project if [ -d "$PROJECT_DIR" ]; then echo "Project already exists; updating..." cd "$PROJECT_DIR" git pull origin main else echo "Cloning project repository..." git clone "$REPO_URL" "$PROJECT_DIR" cd "$PROJECT_DIR" fi # Create virtual environment if [ ! -d "$VENV_DIR" ]; then echo "Creating virtual environment..." python3 -m venv "$VENV_DIR" fi # Install dependencies echo "Installing Python dependencies..." "$VENV_DIR/bin/pip" install -q -r requirements.txt ``` From `scripts/update.sh:24-31`: ```bash # Retrieve latest code echo "Retrieving latest code..." git pull origin main # Update dependencies echo "Updating dependencies..." pip3 install -q -r requirements.txt ``` From `scripts/run.sh:30`: ```bash "$VENV_DIR/bin/python" main.py ``` ### Technical Analysis The installation and update scripts retrieve the mutable `main` branch of an external Git repository without pinning it to a reviewed commit hash or verifying a signed release. The effective code installed by the Skill can therefore change after this version of the Skill has been audited. The cloned repository's dependency manifest is immediately processed by `pip`, and its `main.py` is subsequently executed by `run.sh`. Consequently, compromise of the upstream repository, maintainer account, default branch, or release process could replace reviewed behavior with attacker-controlled code. Fetching an upstream project is related to the declared installation workflow, but accepting and executing an unauthenticated mutable branch exceeds the minimum trust required. A fixed, verified revision would provide the same functionality with a substantially narrower ...[truncated 1260 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the upstream source to a reviewed immutable commit hash: ```bash REPO_COMMIT="<reviewed-full-commit-sha>" git clone --no-checkout "$REPO_URL" "$PROJECT_DIR" cd "$PROJECT_DIR" git checkout --detach "$REPO_COMMIT" ``` 2. Prefer signed, versioned release tags and verify the signature before installation: ```bash git tag -v "$RELEASE_TAG" ``` 3. Do not automatically pull and execute the latest default branch. Make updates explicit and require review of the commit difference before installation. 4. Verify downloaded release archives against a trusted SHA-256 digest when Git signature verification is unavailable. 5. Separate retrieval from execution. Display the resolved commit hash and require approval before installing dependencies or running newly retrieved code. 6. Run installation and analysis under an unprivileged, isolated account with only the filesystem and network access required for stock analysis. ]]>

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding
Dependencies Use Unbounded Lower-Bound Versions Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-6`, `scripts/setup.sh:41-42`, `scripts/update.sh:29-31`, `README.md:24` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `requirements.txt:1-6`: ```text akshare>=1.12.0 pandas>=2.0.0 numpy>=1.24.0 requests>=2.31.0 openai>=1.0.0 python-dotenv>=1.0.0 ``` From `scripts/setup.sh:41-42`: ```bash echo "Installing Python dependencies..." "$VENV_DIR/bin/pip" install -q -r requirements.txt ``` From `scripts/update.sh:29-31`: ```bash # Update dependencies echo "Updating dependencies..." pip3 install -q -r requirements.txt ``` The README also recommends direct unpinned installation at `README.md:24`: ```bash pip3 install akshare pandas numpy requests ``` ### Technical Analysis Every dependency is specified with a lower-bound constraint rather than an exact reviewed version. Future versions satisfying these constraints can therefore be selected automatically. No package hashes are provided, and the scripts do not enforce installation from a locked, reviewed artifact set. Python package installation may execute package build backends or installation-related code. A compromised publisher account, malicious future release, dependency-confusion event, or compromised package distribution channel could consequently introduce attacker-controlled code during setup or update. The use of the public Python package ecosystem is necessary for the Skill's declared functionality, but automatically accepting arbitrary future versions is not. Exact versions and cryptographic hashes would preserve functionality while reducing the required supply-chain trust. ### Attack Path 1. An attacker gains control of a listed package or one of its transitive dependencies, or publishes a compromised future version. 2. The malicious version still satisfies the broad `>=` constraint. 3. A user runs `scripts/setup.sh`, `scripts/update.sh`, or the instal ...[truncated 930 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace lower-bound constraints with exact, reviewed versions: ```text akshare==<reviewed-version> pandas==<reviewed-version> numpy==<reviewed-version> requests==<reviewed-version> openai==<reviewed-version> python-dotenv==<reviewed-version> ``` 2. Generate a lock file containing all transitive dependencies and SHA-256 hashes. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Use a controlled package index or internal artifact mirror and explicitly configure trusted sources. Do not add untrusted extra indexes. 4. Review dependency updates before changing the lock file. Add automated vulnerability, provenance, and license scanning to the update process. 5. Use the virtual-environment interpreter consistently in `scripts/update.sh`: ```bash "$VENV_DIR/bin/python" -m pip install --require-hashes -r requirements.lock ``` 6. Update the README so its installation instructions use the same locked and hash-verified dependency set rather than direct unpinned package installation. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (50)

Tainted flow: 'proxies' from os.environ.get (line 84, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if proxy_url:
            proxies = {'https': proxy_url, 'http': proxy_url}
        
        response = requests.post(url, headers=headers, params=params, json=data, timeout=30, proxies=proxies)
        response.raise_for_status()
        
        result = response.json()
Confidence
95% confidence
Finding
The Gemini path trusts HTTPS_PROXY/https_proxy from the process environment and forwards all outbound model traffic through that proxy. In a skill context, this can redirect API requests and responses—including prompts, stock symbols, technical indicators, and the API key in the query string—to attacker-controlled infrastructure, enabling data exfiltration or response tampering.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose is stock analysis, but detected behavior includes self-update via git pull, local configuration backup, and dependency installation/update with pip3. Hidden maintenance or code-modifying actions materially expand risk because they can alter the runtime, pull unreviewed code, expose secrets in config files, or execute package install hooks outside user expectations.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Allowing a caller-supplied skill_path means an attacker who can influence configuration can point the fetcher at an arbitrary directory containing a malicious scripts/quote_cn_pro.py, which this code will then execute. In a stock-analysis skill, this is especially dangerous because the feature appears innocuous while actually enabling arbitrary local code execution under the agent's privileges.

Credential Access

High
Category
Privilege Escalation
Content
# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# 检查环境变量配置
if [ ! -f "$PROJECT_DIR/.env" ]; then
    echo "❌ 错误: 未找到 .env 配置文件"
    echo "请执行: cd $PROJECT_DIR && cp .env.example .env"
    echo "然后编辑 .env 配置 API Key 和股票列表"
    exit 1
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
cd "$PROJECT_DIR"

# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# 备份当前配置
if [ -f ".env" ]; then
    echo "→ 备份当前配置..."
    cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
fi

# 拉取最新代码
Confidence
84% confidence
Finding
Copying `.env` to timestamped backup files duplicates credentials and secrets, increasing their exposure surface and retention period. In this stock-analysis skill context, `.env` likely contains API keys for market data or related services, so unmanaged backups can leave sensitive tokens lying around in the project directory where they may be committed, read by other users, or included in archives.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
This markdown file uses Chinese throughout for headings, instructions, and conclusions, but does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README documents configuring third-party AI providers and encourages AI-based stock analysis, but it does not clearly disclose that user-provided stock symbols, prompts, and potentially derived portfolio/watchlist context may be transmitted to external services. This creates a privacy and compliance risk because users may unknowingly send sensitive financial interests or trading intent to DeepSeek or Gemini.

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill advertises code-capable behavior involving environment access, file reads, network, and shell, but does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may invoke powerful capabilities without clear least-privilege constraints or user visibility.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Overly broad trigger phrases such as generic stock-analysis requests increase the chance the skill activates in unintended contexts. In a code-capable skill, accidental activation can expose users to unneeded network, file, or shell operations and can cause the agent to act beyond the user's actual intent.

External Transmission

Medium
Category
Data Exfiltration
Content
"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"ai": {
    "provider": "openai",
    "api_key": "sk-替换为你的DeepSeekAPIKey",
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "temperature": 0.3,
    "max_tokens": 4096
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file’s user-directed natural language is written entirely in Chinese, and the generated prompt requires responses in Chinese-specific output values such as '上涨/下跌/震荡' and '买入/持有/观望/卖出'. This imposes a specific language/locale behavior without offering the user any language choice or documented opt-in.

External Transmission

Medium
Category
Data Exfiltration
Content
self.max_tokens = config.get('max_tokens', 4096)
        
        if self.provider == 'openai' and HAS_OPENAI:
            base_url = config.get('base_url', 'https://api.openai.com/v1')
            self.client = OpenAI(api_key=self.api_key, base_url=base_url)
        else:
            self.client = None
Confidence
72% confidence
Finding
The OpenAI client accepts a configurable base_url, which can redirect requests intended for OpenAI to any arbitrary endpoint. If an attacker can influence configuration, they can exfiltrate prompts and API credentials to a malicious server; this is more concerning in a finance skill that may process user portfolio/watchlist data.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Reading proxy settings from environment variables gives this stock-analysis skill an unnecessary network-routing capability not clearly justified by its purpose. That increases the attack surface because any compromised runtime, launcher, or wrapper that sets these variables can silently alter where sensitive outbound analysis traffic is sent.

External Transmission

Medium
Category
Data Exfiltration
Content
if proxy_url:
            proxies = {'https': proxy_url, 'http': proxy_url}
        
        response = requests.post(url, headers=headers, params=params, json=data, timeout=30, proxies=proxies)
        response.raise_for_status()
        
        result = response.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends stock identifiers, names, and technical-analysis data to external LLM providers, but there is no evident user-facing disclosure or consent mechanism in this file. In a finance-related skill, even if the data is not highly sensitive by itself, undisclosed third-party transmission creates privacy, compliance, and trust risks.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The module docstring presents the skill description only in Chinese, and the rest of the user-facing descriptions/comments in this file follow the same pattern. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This code file contains natural-language documentation entirely in Chinese, which effectively imposes a specific language on users and maintainers. Under the policy, language constraints should either be optional for the user or clearly justified as region- or locale-specific.

Static analysis

No suspicious patterns detected.