ClawHub
Back to skill

Security audit

财务分析专业套件

Security checks for vulnerabilities and agentic risk

Overview

This finance skill appears related to its stated purpose, but it needs review because it combines file, command, API, and credential handling with inconsistent and overbroad instructions.

Review before installing in a sensitive workspace. Use it only for finance tasks, keep API keys out of shared repositories, prefer environment variables or a secret manager, run dependency installs in an isolated environment, and confirm before allowing file writes, external API calls, or command execution.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:234
Finding

Financial API Keys Stored in Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 234
Vulnerability Type: Plaintext storage of sensitive credentials
Risk Level: Medium

Complete Relevant Snippet:

text
API Key configuration supports Wind (WIND_API_KEY), Bloomberg
(BLOOMBERG_API_KEY), and THS (THS_API_KEY). API keys are stored
in the local config.yaml file and are not uploaded to a server.

The snippet above is an English rendering of the instruction at the cited location.

Technical Analysis

The documentation explicitly directs users to store financial-data service API keys in a local config.yaml file. It does not require encryption, restrictive filesystem permissions, exclusion from version control, or integration with an operating-system or cloud secret manager.

A local file does not inherently provide secure secret storage. Configuration files are frequently copied into repositories, shared workspaces, diagnostic archives, CI artifacts, and unencrypted backups. Processes or users with access to the workspace may also read the credentials.

No evidence indicates that the skill transmits these keys to an unauthorized destination. The finding concerns insecure credential storage rather than confirmed exfiltration.

Attack Path

  1. A user follows the documented configuration instructions.
  2. The user writes a valid Wind, Bloomberg, or THS API key into config.yaml.
  3. The file remains readable in the project workspace and is not explicitly excluded from version control.
  4. Another local user, compromised process, shared-workspace participant, backup operator, or repository recipient obtains the file.
  5. The exposed key is used to access the corresponding financial-data service within the permissions and quotas assigned to that credential.

Impact Assessment

Successful exploitation can expose the privileges granted to the compromised API key. Depending on the provider and account configuration, this may pe ...[truncated 335 chars]

Remediation
View remediation

Remediation Suggestions

  1. Read API keys from environment variables or a dedicated secret manager instead of storing them in config.yaml.
  2. Provide a config.example.yaml containing placeholders only.
  3. Add the real configuration file and other secret-bearing variants to .gitignore.
  4. Require restrictive permissions, such as owner-only read and write access, if a local secret file is unavoidable.
  5. Prevent credentials from appearing in logs, exceptions, generated reports, and diagnostic archives.
  6. Add automated secret scanning to development and CI workflows.
  7. Document key rotation and immediate revocation procedures for accidentally exposed credentials.
  8. Configure provider credentials with the smallest available permissions, quotas, and allowed-source restrictions.

T08 · Insecure Dependencies

Note
Location
SKILL.md:232
Finding

Unpinned Third-Party Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 232-233
Vulnerability Type: Unpinned and non-reproducible dependency installation
Risk Level: Low

Complete Relevant Snippet:

bash
pip install numpy pandas scipy
pip install matplotlib openpyxl jinja2

Technical Analysis

The installation instructions use mutable package names without exact versions, package hashes, or a reviewed lockfile. Consequently, the installed artifacts depend on whichever releases and transitive dependencies the configured Python package index resolves at installation time.

The named packages are established projects, and the audit found no evidence that they are malicious. Nevertheless, the installation process does not provide reproducibility or integrity pinning. A future compromised release, compromised package index, maliciously configured mirror, or incompatible update could introduce unsafe code into the environment.

Python packages may execute build or installation logic, and imported dependencies execute with the privileges of the Python process. The risk therefore extends beyond incorrect analytical results to potential local code execution if the resolved supply-chain artifact is compromised.

Attack Path

  1. A user follows one of the documented pip install commands.
  2. pip resolves the latest permitted package and transitive dependency versions from its configured index or mirror.
  3. The selected artifact differs from the version originally reviewed or tested.
  4. If that artifact or mirror has been compromised, malicious installation or runtime code executes.
  5. The code runs with the permissions of the user or automation account performing the installation or importing the package.

This is a conditional supply-chain path. The audited project does not contain evidence that any currently named dependency is malicious or that a malicious package source is intentionally configured.

Impact A

...[truncated 449 chars]

Remediation
View remediation

Remediation Suggestions

  1. Supply a reviewed dependency manifest with exact package and transitive dependency versions.
  2. Generate and verify cryptographic hashes for all distributions.
  3. Install with a command such as:
    bash
    pip install --require-hashes -r requirements.txt
  4. Use an organization-controlled package index or allowlisted mirror with transport security and access controls.
  5. Prefer prebuilt, verified wheels and disable source builds where operationally practical.
  6. Scan dependencies for known vulnerabilities and review updates before changing the lockfile.
  7. Install and execute the software in an isolated virtual environment or container under a non-privileged account.
  8. Document the supported Python and dependency versions to make installations reproducible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation text is overly broad, e.g. recommending use whenever efficiency, automation, batch processing, or workflow optimization are needed. In an agent ecosystem, such generic phrasing can cause the skill to be selected for unrelated tasks, expanding its access to read/exec/write capabilities in contexts where the user did not specifically request financial analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown explicitly claims '本技能提供中文交互等能力', and the configuration example sets report language to 'zh-CN' without mentioning alternatives or user opt-in. This suggests a fixed language/locale behavior rather than giving the user a choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes writing reports, using external APIs, and executing scripts/commands, but it does not provide a prominent warning about side effects, data disclosure, or resource usage before those actions occur. In a finance-oriented skill handling potentially sensitive company data and API keys, this omission increases the chance of unreviewed file creation, external transmission, or command execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill presents conflicting capability declarations: it is labeled as pure Markdown/natural-language driven at the end, while elsewhere it advertises exec, write, API access, and command execution. This can mislead an agent or user about the real side-effect surface, causing unsafe trust decisions, incorrect sandboxing, or accidental execution of file/network actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.