ClawHub
Back to skill

Security audit

a-share-daily-review

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches public market data locally to generate a fact-only daily market report, with no evidence of credential access, persistence, exfiltration, or destructive behavior.

Before installing, note that the skill may activate on fairly general market questions and will make outbound requests to public market-data providers through akshare. It does not ask for API keys or credentials and should be treated as a factual data-reporting helper, not investment advice.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrase "global market review" is generic enough that it may match ordinary user requests about markets, causing the skill to activate outside its intended scope. In agent environments, overly broad triggers can lead to unintended tool invocation, surprising behavior, and accidental disclosure or generation of content the user did not explicitly request.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes very broad natural-language phrases such as “今天股市怎么样” and “全球市场”, which can match ordinary conversation and cause the skill to activate unexpectedly. This can lead to unintended execution of market-data retrieval and report-generation behavior, reducing user control and increasing the chance of irrelevant or confusing responses.

Static analysis

No suspicious patterns detected.