Security audit

Stock Theme Events

Security checks for vulnerabilities and agentic risk

Overview

The skill is stock-analysis oriented and not malicious, but it delegates user-controlled stock-code text to a spawned OpenClaw subagent without validation or clear permission limits.

Install only if you are comfortable with the skill spawning OpenClaw subagents and using network-based finance/news sources. Review or patch the stock-code validation and subagent permissions before using untrusted stock lists, pin dependencies before installing, and avoid running the documented git reset --hard command unless you have backed up the repository.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/get_stock_themes.py:31
Finding: Prompt Injection Through Unvalidated Stock Code Input
Content: View full analysis
Remediation: View remediation
str: stock_code = stock_code.strip() if not re.fullmatch(r"\d{6}", stock_code): raise ValueError("Stock code must contain exactly six digits") return stock_code ``` 2. Validate every entry loaded from both command-line input and stock-list files. 3. Reject malformed entries rather than attempting to sanitize arbitrary instruction text. 4. Limit the number of stock codes accepted in one request to prevent uncontrolled subagent spawning. 5. Prefer a structured Skill/API invocation in which the stock code is passed as a typed parameter rather than embedded in a natural-language task. 6. Run delegated subagents with only the tools and permissions needed to retrieve stock themes. 7. Log rejected input safely and avoid including the complete malicious payload in shared logs. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:23
Finding: Mutable and Unpinned Third-Party Dependency Installation
Content: View full analysis
=1.12.0 - sentence-transformers>=2.2.0 - scikit-learn>=1.0.0 - numpy<2（兼容性问题） ``` The referenced `requirements.txt` is not present in the audited artifact. The clustering code also loads a model without pinning a model revision at `scripts/cluster_themes.py:68`: ```python model = SentenceTransformer('paraphrase-multilingual-MiniLM-L12-v2') ``` ### Technical Analysis The installation instructions use `@latest` for npm execution and omit exact versions and integrity hashes for Python dependencies. Lower-bound constraints such as `>=` also permit future releases that were not part of this audit. Package installation can execute package lifecycle or build logic. Consequently, the effective code installed by following these instructions may change after the Skill has been reviewed. The missing `requirements.txt` additionally prevents verification of the dependency set represented by the publication report. `SentenceTransformer` may retrieve model artifacts when the named model is unavailable locally. Because no immutable model revision or artifact hash is specified, model retrieval is also not fully reproducible. There is no evidence in the supplied artifact that any currently named package is malicious. The finding co ...[truncated 1047 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_report.py:79
Finding: Unsanitized External Content Written Into Markdown Reports
Content: View full analysis
150: summary = summary[:150] + "..." section += f"""{j}. **[{title}]({url})** ({publish_time}) - 来源：{source} - 摘要：{summary} """ ``` Theme names and stock codes are also inserted into Markdown without escaping in `scripts/generate_report.py:56-62`: ```python for i, theme_data in enumerate(top_themes, 1): theme = theme_data["theme"] count = theme_data["count"] stocks = theme_data.get("stocks", []) representative = get_stock_names(stocks) rows.append(f"| {i} | {theme} | {count} | {representative} |") ``` ### Technical Analysis News titles, summaries, sources, publication times, URLs, theme names, and stock identifiers are treated as trusted strings even though they can originate from external services or caller-provided JSON files. Truncating a summary by character count does not neutralize Markdown syntax. Crafted content can inject headings, links, images, table delimiters, or additional report sections. URLs are not parsed or restricted to safe schemes and trusted hosts. Depending on the Markdown ...[truncated 1398 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SYNC_REPORT.md:59
Finding: Destructive Git Reset Included in Synchronization Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broader skill centered on obtaining real news events for A-share market themes and producing theme-event analysis. However, this code chunk implements only the theme clustering portion: it reads local JSON input, applies synonym normalization and optional semantic similarity clustering, counts stocks per theme, and saves the clustering output. There is no code for querying Jinshi Data or any other news source, no network access, no event extraction, and no report generation. While clustering similar themes is one sub-step mentioned in the description, the actual code does not cover the skill's main declared purpose of retrieving corresponding real news events, so this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个较完整的题材发现、聚类、新闻获取和分析报告生成流程；但提供的代码片段只覆盖最后一步——将已经准备好的题材数据和新闻数据渲染为 Markdown 报告。代码没有任何股票行情获取、题材聚类、新闻源访问、网络请求或数据抓取逻辑，也没有实现‘获取真实新闻事件’这一核心能力。虽然声明中提到会生成报告，这与代码部分一致，但若将该代码块视为该技能实际行为，其主要能力明显少于声明，且核心描述偏向数据获取与分析而非单纯报告生成，因此存在描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个围绕‘题材对应真实新闻事件’的分析型 skill，核心能力应包括新闻抓取、事件关联、题材聚类与分析报告生成。但代码实际仅是一个批量查询股票题材的辅助脚本：接收股票代码列表，调用外部 openclaw CLI 触发 ths-stock-themes skill，解析返回中的 JSON，提取“涉及概念”，并做本地缓存和输出。其主功能是‘获取个股题材/概念列表’，而不是‘获取题材对应的真实新闻事件’。因此主目的与实际行为存在明显偏差，且多项声明能力完全未在代码中体现。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description promises an end-to-end analysis skill for mapping A-share market themes to real news events. However, this code chunk is only a preparatory/export step: it contains a predefined list of stocks, saves that list locally, and instructs the user to run other components afterward. No network access, news-source querying, theme analysis, clustering, or report creation appears in the supplied code. While saving a stock list is loosely related support functionality, the actual implemented behavior in this chunk is materially narrower than the declared primary purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: git reset --hard origin/main is a destructive command that can wipe local work and force the repository state to match the remote branch. In this skill context, the command appears as operational guidance rather than executable code, but documentation-driven command execution is still risky because users or automated agents may run it without understanding the irreversible consequences.
Content: Scanner excerpt · SYNC_REPORT.md (reported line 64)May include surrounding context.
bash
git checkout -b temp-branch git reset --hard origin/main # HEAD 现在是 92b6742 fix: 整理 cn-stock-volume 目录结构

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest package version at install time rather than a reviewed, pinned version. If the upstream package or its dependency chain is compromised, users could execute attacker-controlled code simply by following the documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command uses npx clawhub@latest, which causes execution of whatever version is current at the time the user runs it. In a supply-chain compromise scenario, the README becomes a delivery path for untrusted code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Invoking npx against an unpinned package version exposes users to mutable upstream content and transitive dependency risk. Because this is installation guidance in a README, the command is likely to be copied verbatim, increasing practical exploitability.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documented npx clawhub@latest usage executes a mutable remote package with no version pinning, making the install path dependent on the current state of the registry. That creates a supply-chain risk where a compromised or malicious release could run arbitrary code during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The release workflow also relies on npx clawhub@latest install skill-publish-tool, extending the same unpinned supply-chain exposure to maintainers. This is especially sensitive because publisher tooling may have access to local credentials, repositories, and release artifacts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description is written only in Chinese and does not indicate that users may interact in other languages or choose a preferred locale. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown includes git reset --hard origin/main, which irreversibly discards local changes, but the document provides no warning or safety guidance. In a skill ecosystem, users or agents may follow setup instructions mechanically, so destructive commands in documentation can cause data loss even if they are not overtly malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring describes the script entirely in Chinese, and the rest of the user-facing strings and argument help text are also Chinese-only. For an all-file-types language policy check, this is a natural-language locale constraint with no opt-in, alternative language, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for obtaining real news events corresponding to A-share market themes, including clustering similar themes, fetching news from sources like 金十数据, and generating theme-event association reports. This file only calls another skill to query each stock's themes/concepts and saves the resulting theme lists, with no code for retrieving news events, clustering themes, or producing association analysis.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script launches an external agent-capable CLI ('openclaw sessions spawn') to satisfy a relatively narrow data-retrieval task. Even without shell injection, delegating work to a broader execution-capable subagent expands the trust boundary and can expose the environment to prompt-injection, excessive capability use, or unintended actions performed by the spawned agent.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/get_stock_themes.py (reported line 43)May include surrounding context.
python
"run" ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=60) if result.returncode == 0: # 解析返回结果（需要从输出中提取 JSON）

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a skill that analyzes hot themes, retrieves real news events from sources like Jin10, and generates a theme-event association report. This script does not perform theme extraction, clustering, news retrieval, or report generation; it only emits a predefined top-gainers list and writes it to a JSON file, making the implemented behavior diverge materially from the claimed end-to-end functionality.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring says '完整执行脚本' and describes obtaining top-performing stocks, analyzing themes, searching news, and generating a report. In reality, the code only prints metadata, writes a static JSON file, and lists manual next steps, which directly contradicts the documentation's claim of complete execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language strings in the docstring and all user-facing print statements are exclusively in Chinese, indicating the skill is designed to operate in a fixed language. Under the policy, language constraints should either provide user opt-in/choice or be clearly documented as a justified region-specific requirement, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all installation, usage, and operational guidance in Chinese only. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill description and usage guidance are written only in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative language option is provided. The README does not state that the repository is intentionally limited to a Chinese-speaking audience or region-specific compliance context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill encourages writing a generated report to a user-specified path, including examples using shell-like paths, without warning about file creation or overwrite risks. In agent environments, ambiguous write behavior can lead to unintended overwrites of existing files or writes to sensitive locations if the caller passes an unsafe path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file forces a single language presentation throughout the skill-related instructions and usage examples without offering users a language or locale choice. The policy calls for flagging language or locale constraints when they are imposed without opt-in or clear documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document's synchronized file inventory at L26-L39 does not include a requirements.txt file, yet the installation section instructs users to run 'pip3 install -r requirements.txt'. This is a direct documentation-to-artifact mismatch in the file's own stated contents and setup steps.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.