ClawHub
Back to skill

Security audit

Stock Deep Report

Security checks for vulnerabilities and agentic risk

Overview

The skill’s stock-report workflow is mostly coherent, but its HTML generator can embed untrusted web or JSON text as active browser code in the generated report.

Install only if you are comfortable reviewing generated HTML from public-market data sources. Prefer a fixed version that escapes every JSON field before rendering, and confirm before allowing persistent memory updates about stocks or reports you generate.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The instruction to '更新工作记忆' introduces persistence of user/task data beyond what is necessary to generate an HTML stock report. Unrelated memory writes can accumulate sensitive behavioral or financial-interest information and create unnecessary data retention risk.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The security comments claim the script only safely renders JSON into HTML, but many JSON-derived values are inserted directly into the document without HTML escaping. Because this report generator produces browser-rendered HTML from externally supplied data, an attacker can place HTML/JavaScript in fields such as titles, notes, table cells, or footer content and trigger stored XSS when the output is opened.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The esc() helper suggests a controlled sanitization model, but later functions bypass it and emit raw input into HTML, creating a false sense of safety. Direct insertion of untrusted fields into element bodies, table cells, and the page title allows injection of arbitrary markup and potentially script execution in the generated report.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger phrases are broad enough to activate on generic stock-related requests, increasing the chance the skill runs when the user did not clearly intend this workflow. Over-broad activation can cause unnecessary network access, data collection, file writes, and generation of investment-style outputs without explicit user opt-in.

Static analysis

No suspicious patterns detected.