三立智期 抢先版

• Outcome: Review
• Latest audit: Aug 14, 2026 · 7:33 AM UTC
• Version: 1.2.8

Overview

This is a coherent futures-trading skill, but it should be reviewed carefully because it can persist trading credentials and place or cancel live orders without strong built-in confirmation gates.

Install only if you intend to connect this agent to Sanli Zhiqi trading. Keep the default sim environment unless you deliberately want live trading, verify any live-capable key and environment before use, and require the agent to restate order details for confirmation before any live place or cancel action. Treat the local credential files as sensitive and remove or rotate the key if the machine or config files may be shared.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises capabilities that can access environment variables, the network, and the shell, yet the manifest does not declare corresponding permissions. In a trading skill that can obtain API keys and place or cancel orders, this hidden capability gap weakens user consent and platform enforcement, increasing the risk of unauthorized credential use, data exfiltration, or command execution through supporting scripts.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list contains broad, high-frequency finance terms that can cause the skill to activate in unrelated conversations. Because this skill can guide credential acquisition, access account information, and support simulated or live trading workflows, accidental invocation expands the attack surface and may nudge users into sensitive actions in the wrong context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation includes a real-money trading example using `X-Trading-Env: live` and a market close order without an explicit warning that it can execute against a live brokerage account and cause irreversible financial loss. In an agent skill context, examples are often copied verbatim into tooling or surfaced to users, so presenting live order syntax alongside sim examples materially increases the chance of accidental real-money execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This documentation exposes live order placement and cancellation capabilities for a real trading environment (`X-Trading-Env: live`) without prominent safety gating, user-consent requirements, or warnings about real-money consequences. In an agent skill context that supports conversational trading, this increases the risk that an agent could place or modify real orders from ambiguous, mistaken, or manipulated user prompts, causing financial loss.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The file defines order placement and cancellation for a trading skill but does not document explicit invocation constraints, disallowed scenarios, or confirmation prerequisites before executing these high-impact actions. In an agent setting, vague action boundaries can cause the model to trigger live trading operations from ambiguous user requests or conversational context, leading to unauthorized or unintended trades.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The documentation exposes high-risk financial actions such as placing and canceling futures orders without any user-facing warning, risk disclosure, or requirement for explicit confirmation. Because this skill operates in a trading context where actions can immediately create financial exposure, the absence of safety messaging and confirmation materially increases the chance of accidental, coerced, or misunderstood transactions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The tool exposes live order placement capability and its description explains operational details, but it does not require or document an explicit user-facing confirmation or warning before a real trade is submitted. In a trading skill, this increases the risk of accidental or socially engineered execution of irreversible financial actions, especially because the same interface supports both sim and live environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The cancel_order function can modify an active live order, but the interface description lacks an explicit user warning or confirmation requirement before cancellation. Although cancellation is protective in some cases, unauthorized or mistaken cancels can disrupt trading strategy, cause missed fills, and create financial loss in fast-moving markets.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger list includes very broad finance-related terms such as '黄金', '铜', '开户', and '正规', which can cause the trading skill to activate in contexts where the user did not intend to invoke a broker-integrated capability. In a skill that can retrieve account data and place/cancel orders, accidental invocation increases the chance of privacy exposure, misleading brokerage responses, or unsafe progression toward sensitive actions.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The instruction to proactively explain and recommend MCP '用几句中文说明' forces Chinese output regardless of the user's language preference. This is primarily a safety and usability issue: language mismatch can confuse users during credential setup or trading-related steps, increasing the risk of mistaken consent or incorrect execution.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The embedded instruction string hard-codes Chinese-only user interaction flow and explicitly tells the model how to communicate, which can override user language preference and reduce informed consent for sensitive trading/login actions. In a financial-trading skill, forcing a specific language during credential collection and order-related guidance increases the chance of user misunderstanding and unsafe actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

}' | jq .

# 下单（市价平仓，live）
curl -s -X POST "$API_BASE/open/v1/orders" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "X-Trading-Env: live" \
  -H "Content-Type: application/json" \

• Confidence: 93% confidence
• Finding: curl -s -X POST "$API_BASE/open/v1/orders" \ -H "Authorization: Bearer ${API_KEY}" \ -H "X-Trading-Env: live" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

}' | jq .

# 撤单（使用下单回报中的字段）
curl -s -X POST "$API_BASE/open/v1/orders/cancel" \
  -H "Authorization: Bearer ${API_KEY}" \
  -H "X-Trading-Env: ${ENV}" \
  -H "Content-Type: application/json" \

• Confidence: 78% confidence
• Finding: curl -s -X POST "$API_BASE/open/v1/orders/cancel" \ -H "Authorization: Bearer ${API_KEY}" \ -H "X-Trading-Env: ${ENV}" \ -H "Content-Type: application/json" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

**走 HTTP 路径时第 5 步之后**：响应 `data.apiKey` 就是完整密钥。**禁止回显给用户**；把它写入 `SLZQ_OPENCLAW_API_KEY` 后继续调用，并提示用户在客户端配置里持久化该变量（否则下次会话还要重领）。MCP 路径无需这一步，工具已自动落盘。

登录成功后：未注册的手机号自动注册；**模拟盘账户自动开通并在响应里回报状态**（`simAccountReady` / `simAccountBalance`，无需回 App 操作）；密钥自动落盘（`~/.slzq-trading/credentials.json`，权限 `0600`；本机装了 OpenClaw 时并入 `~/.openclaw/openclaw.json`），**当前会话立即生效，无需重启**。拿到密钥后**直接继续用户原本的任务**，不要停下来汇报流程。

响应里的 `keyCreated` 告诉你这把钥匙的来历：`true`=本次新签发；`false`=**返回的是该账号原有的模拟盘密钥**，和用户在 App 里看到的是同一把，可以据此安抚"没有生成新密钥、旧配置不受影响"。

• Confidence: 95% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

const TRADING_ENV = "SLZQ_OPENCLAW_ENV";
/** 登录后落盘的凭据文件：宿主不是 OpenClaw 时也能让密钥跨重启生效 */
const CREDENTIALS_DIR = join(homedir(), `.${SKILL_NAME}`);
const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
/** OpenClaw 网关自身的配置；仅在用户确实装了 OpenClaw（目录已存在）时才合并写入 */
const OPENCLAW_CONFIG_FILE = join(homedir(), ".openclaw", "openclaw.json");
const NO_API_KEY_HINT = `尚未配置 ${API_KEY_ENV}。有两种取钥方式，先把两种都告诉用户让其选择，不要替他决定：` +

• Confidence: 94% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

entry.apiKey = apiKey;
        // 只补空缺，不覆盖用户已填的域名/交易环境：本进程的环境变量未必等于用户在网关里的设置，
        // 覆盖会把人家配好的 live 悄悄改成 sim。
        const env = { ...(entry.env ?? {}) };
        if (!env[DOMAIN_ENV])
            env[DOMAIN_ENV] = config.domain;
        if (!env[TRADING_ENV])

• Confidence: 91% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

/** 登录后落盘的凭据文件：宿主不是 OpenClaw 时也能让密钥跨重启生效 */
const CREDENTIALS_DIR = join(homedir(), `.${SKILL_NAME}`);
const CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
/** OpenClaw 网关自身的配置；仅在用户确实装了 OpenClaw（目录已存在）时才合并写入 */
const OPENCLAW_CONFIG_FILE = join(homedir(), ".openclaw", "openclaw.json");

• Confidence: 95% confidence
• Finding: credentials.json

Credential Access

High

• Category: Privilege Escalation

Content

entry.apiKey = apiKey;
    // 只补空缺，不覆盖用户已填的域名/交易环境：本进程的环境变量未必等于用户在网关里的设置，
    // 覆盖会把人家配好的 live 悄悄改成 sim。
    const env = { ...(entry.env ?? {}) };
    if (!env[DOMAIN_ENV]) env[DOMAIN_ENV] = config.domain;
    if (!env[TRADING_ENV]) env[TRADING_ENV] = config.tradingEnv;
    entry.env = env;

• Confidence: 90% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

const env = { ...(entry.env ?? {}) };
    if (!env[DOMAIN_ENV]) env[DOMAIN_ENV] = config.domain;
    if (!env[TRADING_ENV]) env[TRADING_ENV] = config.tradingEnv;
    entry.env = env;
    await writeFileAtomic(OPENCLAW_CONFIG_FILE, `${JSON.stringify(parsed, null, 2)}\n`, 0o600);
    return [`已合并写入 OpenClaw 配置：${OPENCLAW_CONFIG_FILE}（skills.entries.${SKILL_NAME}）`];
  } catch (e) {

• Confidence: 88% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: install/setup-clawhub.mjs:34

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: install/test_mcp_tools.mjs:18

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: install/test_connection.sh:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: runtime/mcp/dist/index.js:60

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: runtime/mcp/src/index.ts:78

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: runtime/mcp/dist/index.js:65

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: runtime/mcp/src/index.ts:83