Security audit

港股美股监控

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible market monitor, but its install command can modify system Python and its script writes state to a hard-coded local path.

Install only after reviewing the script and preferably changing the setup to use a virtual environment with pinned dependency versions. Be aware that it contacts Yahoo Finance for the configured tickers and writes a local JSON state file to /Users/apple/.openclaw/workspace/memory/stocks_monitor.json rather than the relative path shown in the docs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Dependencies Installed Outside an Isolated Environment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/monitor.py:159
Finding: Hard-Coded State Path Permits Unintended File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented behavior does not match the detected capabilities: the skill persists monitoring results to local storage without disclosure, while advertised features such as custom watchlists and alerts are not actually implemented. This mismatch is dangerous because users may grant trust based on the description while the skill performs additional local side effects they were not informed about.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill appears to write a state file (memory/stocks_monitor.json) but does not declare any tool scope or permissions for file-writing behavior. Undeclared write capability weakens transparency and can surprise operators, making it harder to assess what the skill can modify on the local system.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The natural-language description, headings, and usage instructions are all in Chinese, and the file does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. The policy for SQP-3 flags language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file presents its title, comments, and runtime output in Chinese, including the main status lines shown to users. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the tool is explicitly documented as region-specific or offers a language choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code persists stock monitoring data to a local JSON file, but there is no visible warning, confirmation, or explicit user-facing disclosure that a file will be created or overwritten at that path. For code files, file writes should not be silent unless the behavior is clearly disclosed or obviously integral to the skill's stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file describes installing and running a real-time market monitor using yfinance, which necessarily fetches data over the network, but it does not include any user-facing warning about external network access. Under the markdown variant of SQP-2, skills that may affect privacy or system/network behavior should disclose that behavior clearly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a market-monitoring skill focused on fetching prices and technical indicators, but this script additionally writes collected state to a fixed local path. Local persistence is not mentioned in the description and goes beyond pure monitoring/output behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.