ClawHub
Back to skill

Security audit

Stock-A

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward A-share stock quote helper that contacts named market-data providers, with no hidden persistence or unrelated access found.

Install optional Python packages only in a virtual environment and consider pinning reviewed versions. Expect the scripts to contact external finance-data providers and send the requested stock codes when you run them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:143
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:143-150
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

The installation instructions contain the following dependency installation commands:

bash
## Install a new data source

# Install mootdx if it is not already installed
pip install mootdx

# Install Tushare as a fallback
pip install tushare

Technical Analysis

The Skill instructs users to install mootdx and tushare directly from the configured Python package index without specifying reviewed versions, cryptographic hashes, a lockfile, or a trusted index URL. Consequently, the exact installed artifacts and their transitive dependencies can change between installations.

Python package installation may execute package-controlled build-system or setup code. If a package release, maintainer account, distribution channel, or transitive dependency is compromised, following these instructions could execute attacker-controlled code during installation. The external packages and their installation behavior are not included in this repository and therefore could not be verified by this audit.

This finding identifies a supply-chain weakness; the audited repository does not itself demonstrate that either named package is malicious.

Attack Path

  1. An attacker compromises a referenced package, one of its transitive dependencies, its maintainer account, or the package distribution channel.
  2. The attacker publishes a malicious release or modifies an artifact that remains compatible with the unconstrained package name.
  3. A user follows the instructions and runs pip install mootdx or pip install tushare.
  4. Pip resolves the mutable malicious release or dependency because no version or hash constraint is present.
  5. Attacker-controlled build, setup, import, or runtime code executes in the user's environment.

Impact Assessment

Successful exploi ...[truncated 464 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency file that pins exact package and transitive-dependency versions.
  2. Record cryptographic hashes for every permitted distribution and install with:
    bash
    pip install --require-hashes -r requirements.txt
  3. Generate and maintain the lockfile with a dependency-management tool such as pip-tools, reviewing changes whenever dependencies are updated.
  4. Explicitly configure and document the trusted package index rather than relying on ambient pip configuration.
  5. Prefer binary wheels from verified publishers where appropriate, and inspect package provenance and release signatures when available.
  6. Install packages in an isolated virtual environment under a non-privileged account; do not use administrative or root installation.
  7. Add automated dependency vulnerability and integrity scanning to the release process.
  8. Document the reviewed versions in SKILL.md and replace unconstrained installation examples with the locked installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The skill content, headings, and usage guidance are presented only in Chinese, with no opt-in, alternative language option, or explicit justification that the skill is limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language usage instructions solely in Chinese, and the script also emits Chinese-only user-facing messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script returns and prints user-visible status and error messages only in Chinese, which enforces a single locale for all users. The stated policy requires either user choice/opt-in or a clearly documented and justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This SKILL.md is a markdown file, so SQP-2 applies to omitted warnings in the description. The document instructs users to query remote providers such as 新浪财经、腾讯财经、东方财富 and Tushare, but it does not disclose that using these examples sends stock queries and system-originated requests to third-party services.

Content

No source excerpt is available for this finding.