Security audit

Earnings Tracker

Security checks for vulnerabilities and agentic risk

Overview

This financial-report scanner has a plausible purpose, but its documentation overpromises features while the script writes persistent output to a fixed OpenClaw memory path without clear disclosure or user control.

Review this skill before installing. It appears intended to scan Chinese A-share earnings data, but do not expect the advertised U.S. market scanning, scheduling, or Discord/Telegram delivery to work as documented. Run it only in an isolated environment, pin and review akshare, and change the script to use an explicit user-approved output path outside shared agent memory unless persistent storage is actually desired.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:52
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/earnings_scanner.py:160
Finding: Unsafe Hard-Coded Write into the Agent Workspace
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: There is a meaningful mismatch between the documented purpose and the detected behavior: promised features such as US earnings-calendar scanning and Discord/Telegram delivery are not implemented, while an undeclared local file-write behavior is present. This discrepancy is dangerous because users and reviewers may grant trust based on the description while the actual behavior performs different actions, including a more sensitive capability than disclosed.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill advertises scheduling, scanning, and notifications but does not declare any explicit tool scope or permissions boundary while static analysis detected file-write capability. Undeclared write access increases the chance of surprising side effects, such as creating or modifying local files outside user expectations, and makes review and sandboxing harder.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content of the skill is presented entirely in Chinese, including the description, headings, workflow, and examples, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a locale-policy concern unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file describes automatic Discord and Telegram notifications, which can disclose the user's watchlist or tracking activity to third-party messaging platforms. Although the workflow mentions waiting for user confirmation before creating reminders, the description does not clearly warn about the privacy implications of sending data to external channels.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s natural-language description and all user-facing prompts are written in Chinese and explicitly label the tool as a China-only version. It does not indicate any user opt-in, language selection, or justification for requiring Chinese output, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring explicitly lists '推送到 Discord/Telegram' as a function of the script. However, no messaging API, webhook call, or bot integration exists; the code only prints a report and writes it to a JSON file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a tracker that scans both A-share and U.S. earnings calendars and pushes important updates. In the implementation, only Chinese-market AKShare APIs are queried, there is no U.S. earnings retrieval logic, and the final output is persisted to a local JSON file rather than sent to Discord or Telegram.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes results to a fixed absolute path in the user's workspace without prior warning or confirmation. In an agent setting, silent filesystem writes can surprise users, overwrite prior data, leak information into shared workspace state, or create persistence that later tools/processes consume unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The package description is written in Chinese and explicitly labels the skill as the 'China version', focused on A-share earnings calendars. This indicates a locale-specific constraint without any visible language or locale choice for users in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.