ClawHub
Back to skill

Security audit

财搭子：让你变得更强的投资Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed finance-analysis API integration, with manageable privacy and configuration risks rather than evidence of hidden or malicious behavior.

Install only if you are comfortable sending finance queries, tickers, and related prompt content to the provider's API. Keep TOOL_API_TOKEN secret, do not commit it to files, and leave TOOL_API_URL at the default unless you intentionally control and trust the replacement HTTPS endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'api_url' from os.getenv (line 43, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
data = {"tool_name": tool_name, "parameters": parameters}

    try:
        response = requests.post(api_url, json=data, headers=headers, timeout=timeout)
        response.raise_for_status()
        return response.json()
    except requests.RequestException as e:
Confidence
95% confidence
Finding
The request destination is taken directly from the TOOL_API_URL environment variable and used in requests.post while the Authorization bearer token is attached to every request. If an attacker can influence the environment or deployment config, they can redirect traffic to an attacker-controlled endpoint and exfiltrate the API token and any submitted research data. In an agent/tooling context, this is more dangerous because the script is explicitly designed to send authenticated requests and may be run in shared CI, container, or plugin environments where env vars are easier to tamper with.

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill uses environment variables and makes outbound network calls to an external API, but it does not declare corresponding permissions. This creates a governance gap: reviewers and runtime policy engines may underestimate the skill's capabilities, reducing visibility into credential use and data egress.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger examples and supported dimensions are broad enough to match ordinary financial conversation, which can cause the skill to activate when a user is merely discussing stocks rather than explicitly requesting this tool. Over-broad activation can route user content to an external skill unnecessarily, increasing data exposure and causing unintended tool use or misleading investment-style outputs.

Natural-Language Policy Violations

Medium
Confidence
79% confidence
Finding
The README is written entirely in Chinese and presents usage/output expectations only in that language, which can pressure the agent to respond in Chinese even when the user has not requested it. This is primarily a safety and usability issue: forced language behavior can mis-handle user intent, conceal important disclaimers, or reduce the user's ability to validate financial recommendations.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger keywords are broad and overlap with common financial discussion terms, which can cause the skill to activate in contexts the user did not intend. Mis-triggering is dangerous here because activation can lead to external transmission of user queries and asset information to a third-party API.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document instructs users to configure an API token and send requests to a remote tool service, but it does not warn that prompts, symbols, and analysis queries are transmitted to an external endpoint or that the token must be handled as a secret. In an agent skill context, this omission can lead to inadvertent disclosure of sensitive user inputs or credential mishandling.

Ssd 1

High
Confidence
97% confidence
Finding
The instruction that the user's explicit instructions are the highest priority can semantically override safer system, policy, or tool-governance constraints. In a skill that can send user content to external services, this increases the chance of prompt-injection-driven data exfiltration, unsafe tool use, or bypass of validation requirements.

External Transmission

Medium
Category
Data Exfiltration
Content
- name: TOOL_API_URL
    description: |
      Optional: Override the default API endpoint URL.
      Default: https://api.facaidazi.com/api/tools/call
    required: false
---
Confidence
89% confidence
Finding
The skill is designed to transmit user queries and asset identifiers to an external API endpoint, and it also allows the endpoint to be overridden via an environment variable. External transmission is expected for functionality, but the override capability materially increases risk by enabling redirection of sensitive requests to an untrusted host if configuration is compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Token 安全**: TOOL_API_TOKEN 是访问凭证，请妥善保管，不要泄露

### API 可用性
- **默认端点**: https://api.facaidazi.com/api/tools/call
- **超时设置**: 300 秒（5 分钟）
- **可通过 TOOL_API_URL 环境变量自定义端点**
Confidence
88% confidence
Finding
The documented default endpoint confirms that the skill sends request data to a third-party service. Given the skill processes free-form user queries, the context raises privacy and compliance concerns because sensitive investment-related prompts may be transmitted off-platform.

Static analysis

No suspicious patterns detected.