T09 · Insecure Skill Coding Practices
Error
- Location
references/API_REFERENCE.md:13- Finding
Command Injection Through Unsafe Refresh Token Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
China iFinD Skill(同花顺Skill)
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate iFinD financial API helper, but it asks users to share and store a long-lived token unsafely and exposes portfolio-changing actions.
Review before installing. Use only with a secure secret-management path for IFIND_REFRESH_TOKEN, avoid pasting tokens into chat, restrict file permissions if local storage is unavoidable, and do not allow portfolio_manage mutation actions unless you explicitly intend to let the agent alter portfolio data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ifind-api.py:118- Finding
Access Token Cached in Plaintext Without Enforced File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly tells the user to send their refresh token to the assistant, which is a direct request for a sensitive credential in natural language. Even if intended for convenience, this trains users to disclose secrets in chat and can expose long-lived API access to the model, logs, or other unintended handling paths.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Instructing users to send a refresh token directly to the assistant creates a social-engineering pattern that solicits credential disclosure. In this skill's context, the token is the primary authenticator for accessing financial data APIs, so exposure could allow unauthorized API usage, quota abuse, or access to account-linked data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The instruction to probe for IFIND_REFRESH_TOKEN in a local .env file is credential-handling behavior. Even though it is framed as a presence check, it normalizes direct agent interaction with secret storage paths and can expose sensitive environment layout or lead to broader secret access patterns beyond the skill's stated purpose.
- Content
每次调用 API 前，先检查
IFIND_REFRESH_TOKEN是否已配置：bash grep -q 'IFIND_REFRESH_TOKEN=.' ~/.openclaw/skills/ifind-api/.env 2>/dev/null && echo "ok" || echo "missing"如果返回
missing，停止执行，提示用户提供 refresh_token。
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The instruction to write a user-supplied refresh token into ~/.openclaw/skills/ifind-api/.env is direct credential persistence to disk by shell command. This is dangerous because it creates a durable secret on the filesystem without access-control guidance, audit boundaries, or confirmation that the storage location is secure, increasing risk of credential theft and unauthorized API access.
- Content
用户提供 token 后，写入配置：
bash sed -i '' 's/^IFIND_REFRESH_TOKEN=.*/IFIND_REFRESH_TOKEN=用户提供的token/' ~/.openclaw/skills/ifind-api/.env写入成功后告诉用户「已配置好，正在为你查询...」，然后继续执行 API 调用。
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is described as a financial data query tool, but the reference includes portfolio creation, cash movements, imports, and trade execution-like operations. In an autonomous or semi-autonomous agent, this materially broadens the capability from read-only analysis to state-changing financial actions, creating risk of unauthorized portfolio modification or user harm if the agent invokes the wrong endpoint.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ═══════════════════════════════════════════════════ # .env 加载 # ═══════════════════════════════════════════════════ def load_env():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ═══════════════════════════════════════════════════ # .env 加载 # ═══════════════════════════════════════════════════ def load_env():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ═══════════════════════════════════════════════════ def load_env(): env_file = os.path.join(SKILL_DIR, ".env") env = {} try: with open(env_file, "r", encoding="utf-8") as f:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares access to an environment secret and describes file and network behavior, but does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and makes it harder for a host or reviewer to understand and constrain what the skill can access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Most of the operational instructions and user-facing prompt text are only in Chinese, including the required setup and stop-condition guidance. Because no language choice or opt-in is offered, this can violate language/locale policy expectations for user-selectable interaction.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs the agent to inspect and modify a local ~/.openclaw/skills/ifind-api/.env file before serving a request. That is a state-changing local filesystem action involving credentials, and it is not necessary for a simple read-only financial data query workflow to tell the model to perform arbitrary shell-based secret management. In an agent setting, this expands the skill from data retrieval into local credential handling and file mutation, increasing risk of unintended secret exposure or tampering.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document tells the user to provide a refresh token and instructs writing it directly into a local .env file, but gives no warning about secret sensitivity, storage implications, or safe handling. This encourages insecure credential collection and persistence, which can lead to token leakage, reuse by other local processes, or accidental disclosure in logs or support artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The portfolio management examples include creating portfolios, importing records, cash deposit/withdrawal, and trade operations without an explicit warning that these actions modify persistent financial state. In agent environments, lack of friction or warning around such operations increases the chance of accidental execution and user misunderstanding about consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script reads the sensitive IFIND_REFRESH_TOKEN from the environment and uses it to request an access token via HTTP headers. While the code performs the action as part of its function, there is no visible confirmation prompt or user-facing disclosure in the executable path that sensitive credentials will be used and sent to a remote API.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. This reference file presents all instructions and examples in Chinese and does not indicate that the language is optional, selectable, or justified as region-specific documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The top-level docstring states 'Python 实现', and the script's user-facing messages are written only in Chinese, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
- Content