ClawHub
Back to skill

Security audit

Stock Clawhub

Security checks for vulnerabilities and agentic risk

Overview

This stock skill is not clearly malicious, but it overstates its analysis abilities and sends financial queries to an undocumented mock data service.

Review before installing. The skill appears to be a small stock-query script, but its documentation promises more than it delivers and names reputable data sources while the code uses api.mock-stock.com. Do not rely on its prices or recommendations for financial decisions unless the provider, disclosures, validation, and data provenance are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/stock_query.py:7
Finding

Undocumented and Untrusted Market-Data Endpoint

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/stock_query.py:7
Finding

Unsafe Construction and Handling of External HTTP Requests

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明强调“查询和分析”且列出基本面分析、技术指标分析等较具体能力，但代码实际仅包含4个功能：查询价格、查询股票信息、查询ETF信息、获取推荐列表。代码没有任何分析算法、指标计算、基本面处理逻辑，也没有体现对A股/港股/美股的专门支持或市场区分。高潜力股推荐也只是调用外部recommend接口，而非自身分析生成。因此描述明显超出了代码实际行为，属于能力宣称与实现不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares network-backed functionality through its described stock/ETF query features and listed external data sources, but does not define any explicit tool scope such as permissions or allowed-tools. This creates an authorization and governance gap: an agent implementation may gain broader network access than intended, making outbound requests harder to constrain, review, or sandbox.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and the entire user-facing documentation are written in Chinese, and all example commands use Chinese trigger words such as "/股票", "/关注", and "/推荐". The file does not indicate that the skill is intentionally region-specific or offer users a language/locale choice, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's docstrings and CLI output are consistently presented in Chinese, and there is no option for users to select another language or opt into this locale. This can violate language/locale policy where skills should not force a specific language without user choice or clear justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stock_query.py (reported line 13)May include surrounding context.

python
"""
    try:
        # 这里使用一个模拟 API，实际应该使用真实的股票 API
        response = requests.get(f"https://api.mock-stock.com/price?code={stock_code}")
        data = response.json()
        return data.get("price", "无法获取价格")
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stock_query.py (reported line 24)May include surrounding context.

python
"""
    try:
        # 这里使用一个模拟 API，实际应该使用真实的股票 API
        response = requests.get(f"https://api.mock-stock.com/price?code={stock_code}")
        data = response.json()
        return data.get("price", "无法获取价格")
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stock_query.py (reported line 35)May include surrounding context.

python
"""
    try:
        # 这里使用一个模拟 API，实际应该使用真实的股票 API
        response = requests.get(f"https://api.mock-stock.com/price?code={stock_code}")
        data = response.json()
        return data.get("price", "无法获取价格")
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/stock_query.py (reported line 46)May include surrounding context.

python
"""
    try:
        # 这里使用一个模拟 API，实际应该使用真实的股票 API
        response = requests.get(f"https://api.mock-stock.com/price?code={stock_code}")
        data = response.json()
        return data.get("price", "无法获取价格")
    except Exception as e:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code transmits the user-provided stock code to an external HTTP endpoint, but there is no user-facing disclosure near the operation indicating that input will be sent to a third-party service. Similar undisclosed outbound requests also occur in the other query functions, which may matter for privacy-sensitive usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The function sends the user-provided ETF name to an external network service, but the script does not warn users that their query terms will be transmitted off-system. For a command-line tool, a visible notice in help output or documentation would satisfy the disclosure expectation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.