ClawHub
Back to skill

Security audit

实时行情跟踪

Security checks for vulnerabilities and agentic risk

Overview

The skill is a stock quote helper, but it asks for shell command authority that is not clearly needed or safely scoped.

Review this carefully before installing. The market-data features are plausible, but the skill grants shell execution without a narrow explanation or safeguards. Install only if you trust the publisher and are comfortable with the agent having command-execution capability in this skill context.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The manifest enables the exec tool even though realtime quote tracking does not require shell access. Unnecessary command execution materially increases the attack surface: if prompted by user input, downstream logic, or future extensions, the skill could execute arbitrary system commands, access local data, or be chained into broader host compromise.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The document asserts there is no eval/exec or untrusted external command execution, yet the manifest explicitly grants exec capability. This contradiction is dangerous because it can mislead reviewers, operators, or higher-level agents into trusting a skill that has far more power than disclosed, increasing the chance of unsafe invocation and inadequate monitoring.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill advertises command execution while lacking a clear user-facing warning about system impact, and the manifest does grant exec. In context, that makes accidental or socially engineered command execution more plausible because users are not clearly informed that this quote-tracking skill can affect the local environment.

Static analysis

No suspicious patterns detected.