ClawHub

东方财富金融工具集

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Eastmoney financial-data skill that sends stock-related queries to its API using an API key, with no hidden install or persistence behavior found.

Install only if you are comfortable providing an Eastmoney API key and sending stock-related query text to Eastmoney's API. Use a dedicated key, avoid putting personal or confidential information in financial queries, and do not expose the vault file or key contents in chat or logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. 选股 API

```bash
curl -X POST "${API_BASE}/finskillshub/api/claw/stock-screen" \
  -H "Content-Type: application/json" \
  -H "apikey: ${API_KEY}" \
  -d '{"keyword": "用户查询", "pageNo": 1, "pageSize": 20}'
Confidence
83% confidence
Finding
curl -X POST "${API_BASE}/finskillshub/api/claw/stock-screen" \ -H "Content-Type: application/json" \ -H "apikey: ${API_KEY}" \ -d '{"keyword": "用户查询", "pageNo": 1, "pageSize": 20}' ``` 适用场景： -

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal