ClawHub
Back to skill

Security audit

Skills of convertible bond data released by ft.tech.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only Chinese market-data helper that fetches convertible-bond and related trading-date data from a disclosed public API.

Install this only if you are comfortable with the agent running the bundled Python scripts and sending bond symbols, date ranges, and similar market-query parameters to market.ft.tech. It does not appear to access private files or credentials, but the documentation is Chinese-only and depends on that external data service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is described as a convertible-bond data toolkit, but the documented behavior also introduces a trading-calendar/date lookup capability that is broader than the declared purpose. Description/behavior drift is dangerous because it can hide additional operational capability from reviewers, causing agents to invoke functions users did not reasonably consent to and weakening security review of what the skill actually does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
`run.py` 与本文件（`SKILL.md`）位于同一目录。执行时：

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs the agent to execute a local Python entrypoint and states the skill uses network, shell, and file path resolution, but it does not declare any explicit tool restrictions or permissions. In an agent environment, missing scope boundaries increases the chance of unintended command execution, filesystem access, or network use beyond what reviewers and policy layers expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The natural-language content throughout the skill is entirely in Chinese and frames the skill around Chinese user phrasing such as '用户询问…时使用' and '询问方式（用户常说的词）' without any indication that other languages are supported. This creates a locale/language constraint without opt-in or justification, which matches the policy-violation category for forced language or locale.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · run.py (reported line 51)May include surrounding context.

python
handler = os.path.join(sub_skills_dir, subskill, "scripts", "handler.py")

    result = subprocess.run(
        [sys.executable, handler] + sys.argv[2:],
        cwd=SKILL_ROOT,
    )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and heading are entirely in Chinese and present the skill as operating in that language, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regulatory or regional context. Under the stated policy, a fixed language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s user-facing natural language strings, including the module docstring, CLI description, and argument help, are entirely in Chinese with no option to select another language. This can violate language/locale policy when the skill imposes a specific language without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description and document content are entirely in Chinese and implicitly require Chinese-language queries such as '用户问可转债列表、全部可转债、转债代码列表、有哪些可转债时使用'. This constitutes a language/locale constraint without any stated user opt-in or alternative language support.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a skill for A-share convertible bond data, including bond lists, bond details, conversion price/value, and K-line historical market data. This file instead fetches the current date's previous N trading dates from a general market time API, which is outside the described convertible-bond-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and CLI usage examples are presented only in Chinese, and the runtime error/usage messages are also Chinese-only. This creates a language/locale policy concern because the skill enforces a specific language without any user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language strings in the module docstring, argument parser description, and help messages are all written in Chinese, with no indication that another language is supported or that this locale is required. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring is written only in Chinese ("获取可转债全量列表（market.ft.tech）"), which indicates a fixed language choice in user-facing descriptive text. There is no accompanying option, fallback, or justification showing that the skill is intentionally region-specific or that users can choose their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description is written as an instruction keyed to Chinese user phrasing only, using examples like '用户问前 N 个交易日、近 N 天交易日'. This indicates a Chinese-only invocation pattern and does not document any user opt-in or alternative language support, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains user-facing natural-language strings exclusively in Chinese in the module docstring, CLI description, help text, and error output. That can violate a language/locale policy when the skill does not offer user opt-in or document that it is intentionally restricted to Chinese users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.