tradealpha实时新闻

PassAudited by ClawScan on May 9, 2026.

Overview

This instruction-only skill is coherent for TradeAlpha news lookup, but it does require you to paste a TradeAlpha token into chat and reuse it within the current session.

Before installing, be comfortable pasting a TradeAlpha token into chat and having it sent to the documented TradeAlpha API endpoints. Prefer a revocable or limited-scope token, verify the listed TradeAlpha website and API domains, and start a fresh conversation if you want to prevent session reuse.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone installing this should understand that their TradeAlpha token will be visible in the chat context and used to authenticate API requests.

Why it was flagged

The skill requires the user to provide a TradeAlpha credential in chat and sends it to the TradeAlpha API. This is expected for the stated integration and is clearly disclosed, but it is still credential use.

Skill content

如果当前会话里还没有 `TradeAlphaToken`，不要构造请求、不要调用接口，必须先提示用户直接在聊天里输入 token... Send `Content-Type: application/json` and include `token` in the JSON body.

Recommendation

Use a scoped or revocable TradeAlpha token if available, verify the TradeAlpha domains before sharing it, and revoke or rotate the token if it is accidentally exposed.

Low

#ASI06: Memory and Context Poisoning

What this means

Later TradeAlpha news requests in the same chat may automatically use the previously provided token.

Why it was flagged

The token is retained in conversation context for reuse during the same session. The artifact also limits storage by forbidding files, environment variables, shell commands, and local config.

Skill content

Session rule: once the user provides a token, remember and reuse it for all later TradeAlpha requests in the same conversation/session
- Storage rule: do not write the token to files, env vars, shell commands, or local config

Recommendation

If you do not want continued reuse, start a new conversation or explicitly tell the agent to stop using the token; avoid pasting unrelated secrets into the same chat.