ClawHub
Back to skill

Security audit

财务分析专业套件

Security checks for vulnerabilities and agentic risk

Overview

This finance-analysis skill is mostly coherent, but it asks for broad read/write/command authority while using overly broad activation language and giving risky credential/dependency setup guidance.

Install only if you need finance-specific automation and are comfortable granting read/write/command execution for that workflow. Use a dedicated virtual environment, pin dependencies, avoid administrator installs, keep API keys in environment variables or a secret manager rather than config.yaml, and do not let the skill auto-activate for generic productivity or workflow requests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:378
Finding

Unpinned Python Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:378-383
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

bash
pip install numpy
pip install pandas
pip install scipy
pip install matplotlib
pip install openpyxl
pip install jinja2

Technical Analysis

The installation instructions do not specify exact package versions, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, the components installed at execution time may differ from those reviewed or tested by the project author.

Python packages can execute package-controlled code during installation and when imported. If a dependency release or package-distribution account is compromised, following these instructions could introduce attacker-controlled code into the analysis environment. Ordinary incompatible upstream updates could also cause non-reproducible behavior.

The package names shown are established packages, and the audit found no evidence that they are currently malicious. The vulnerability is the absence of controls that bind installations to reviewed artifacts.

Attack Path

  1. An attacker compromises a listed package, its maintainer account, or the package-distribution channel.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented unpinned pip install instructions.
  4. Package resolution selects the attacker-controlled release.
  5. Malicious code executes during installation or when the financial-analysis process imports the package.

Impact Assessment

Exploited dependency code would normally execute with the privileges of the user running pip or the analysis process. It could access financial input data, generated reports, configuration files, environment variables, and API credentials available to that user. It could also modify user-writable files or communicate with external ...[truncated 298 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed version.
  2. Maintain a lockfile that records resolved transitive dependencies.
  3. Require package hashes, such as with pip install --require-hashes.
  4. Configure an explicitly trusted package index or an internally controlled package mirror.
  5. Install dependencies in a dedicated virtual environment without administrator privileges.
  6. Add automated dependency vulnerability and provenance scanning.
  7. Test and review dependency upgrades before updating the lockfile.
  8. Document a repeatable installation command that consumes the reviewed lockfile rather than installing unconstrained latest releases.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:239
Finding

Documentation Directs Users to Store API Credentials in a Local Configuration File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:239-243
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippet

The documentation provides the following configuration workflow:

bash
python3 init_pro.py --workspace ./analysis_workspace
cp config_template.yaml config.yaml
# Edit config.yaml and enter the data-source credentials.

It later states that API keys are stored in the local config.yaml file. The English comment above is a faithful translation of the corresponding source instruction.

Technical Analysis

Directing users to place API credentials in a regular workspace configuration file creates a plaintext secret-storage risk. Such files can be unintentionally committed to source control, included in archives or backups, copied when a workspace is shared, exposed through overly permissive filesystem permissions, or read by another process operating under the same user account.

This guidance is also inconsistent with the example configuration, which uses environment-variable placeholders such as ${WIND_API_KEY} and ${BLOOMBERG_API_KEY}, and with the later recommendation against placing secrets directly in configuration files. Ambiguous instructions increase the likelihood that users will replace placeholders with literal credentials.

The audit found no implementation that uploads config.yaml, and no credential-exfiltration behavior was identified. The confirmed issue is insecure local handling and documentation of sensitive credentials.

Attack Path

  1. A user copies the configuration template to config.yaml.
  2. Following the documentation, the user places a literal Wind, Bloomberg, or THS API key in that file.
  3. The configuration file is committed, shared, archived, backed up, or made readable to another local process or user.
  4. An unauthorized party retrieves the credential.
  5. The exposed credential is used against the assoc ...[truncated 591 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions that tell users to enter literal credentials into config.yaml.
  2. Require environment-variable references or integration with an operating-system or enterprise secret manager.
  3. Ensure the template contains placeholders only and fails safely when required environment variables are absent.
  4. Add config.yaml, secret files, and generated workspace credentials to source-control ignore rules.
  5. Apply restrictive filesystem permissions to any unavoidable local secret file.
  6. Add automated secret scanning to development and release workflows.
  7. Document credential rotation and immediate revocation procedures.
  8. Use provider keys with minimum necessary permissions, restricted origins where supported, and conservative usage limits.
  9. Redact credentials from logs, generated reports, exceptions, and callback payloads.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description uses very broad activation language such as improving efficiency, automation, batch processing, and workflow optimization, which can match many generic user requests unrelated to finance. In an agent environment with exec, read, and write enabled, over-broad routing increases the chance this skill is invoked inappropriately and given access to sensitive files or command execution during unrelated tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The capability coverage section enumerates expansive keywords and fragmented trigger phrases that function like catch-all routing terms. This makes the skill easier to auto-select for broad enterprise or automation requests, which is risky because the skill advertises file handling, API access, and command execution capabilities that may then be applied outside its intended domain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The configuration hard-codes language to zh-CN without presenting user choice or opt-in. While not a direct code-execution issue, forced locale can cause misinterpretation of financial output, compliance language, or risk disclosures for users expecting another language, which can degrade review quality and lead to operational mistakes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.