T01 · Skill Instruction Hijacking
Error
- Location
scripts/set_alert.py:25- Finding
Persistent OpenClaw Task Sends Alerts to a Hard-Coded External Recipient and Accepts Prompt Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
A股股票交易助手
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill mostly matches its stated purpose, but its alert feature creates recurring OpenClaw jobs that message a hard-coded QQ recipient.
Review this skill carefully before installing. Do not use the price alert feature unless the hard-coded QQ recipient is removed or replaced with your own confirmed destination, and avoid running the simulation reset until the state path and backup behavior are fixed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/simulate_trading.py:18- Finding
Simulation State Is Written to a Fixed Root-Level OpenClaw Workspace Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill creates persistent scheduled jobs, sends outbound notifications, and contains a hardcoded recipient ID while presenting itself as a stock-analysis assistant, that is a meaningful undeclared-behavior risk. Persistent automation and fixed exfiltration/notification targets expand the blast radius beyond local analysis and can be abused for covert messaging, unwanted task persistence, or data leakage.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/simulate_trading.py
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises and invokes local scripts that imply shell execution plus file read/write behavior, but the manifest does not declare any explicit tool scope or permissions. This weakens the trust boundary for agents and reviewers, making it easier for a skill to exercise broader capabilities than users expect and increasing the chance of unsafe execution in environments that rely on manifest-declared restrictions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description and the entire user-facing README content are written in Chinese and target A股 usage, but the file does not state that the skill is region-specific or provide any language/locale opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document provides concrete buy/sell signals, position-sizing guidance, and stop-loss/take-profit rules without any risk disclosure or suitability warning. In the context of a stock-trading skill that supports strategy generation and aggressive simulated trading, users may over-trust these prescriptive rules as financial advice, leading to significant financial harm or unsafe automated downstream use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file presents its title, usage, and behavior description exclusively in Chinese, and the CLI output throughout the script follows the same pattern. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://qt.gtimg.cn/q={stock_code}" try: result = subprocess.run( ["curl", "-s", url], capture_output=True, timeout=10
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://qt.gtimg.cn/q={stock_code}" try: result = subprocess.run( ["curl", "-s", url], capture_output=True, timeout=10
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://qt.gtimg.cn/q={stock_code}" try: result = subprocess.run( ["curl", "-s", url], capture_output=True, timeout=10
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://qt.gtimg.cn/q={stock_code}" try: result = subprocess.run( ["curl", "-s", url], capture_output=True, timeout=10
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and later user-facing output indicate the skill is designed to communicate only in Chinese. Under the policy rules, forcing a specific language without user opt-in or justification is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes a stock analysis assistant with features like industry fund-flow analysis, where network access is expected. However, invoking an external program through subprocess is a separate execution capability beyond ordinary data retrieval and is not necessary to fulfill the stated purpose. This expands the skill's operational power in a way the manifest does not justify.
- Content
Static analysis
No suspicious patterns detected.