ClawHub
Back to skill

Security audit

掘金量化skill

Security checks for vulnerabilities and agentic risk

Overview

This trading skill matches its stated purpose, but it should be reviewed because it handles trading credentials unsafely and can run strategy code with broad local access.

Install only if you are comfortable reviewing generated strategy code before it runs. Do not paste real tokens into chat, rotate the exposed token if it is yours, use a least-privilege token, avoid live mode until explicit safeguards are added, and run strategy scripts in an isolated environment with a minimal allowlisted environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/test_all_premium_apis.py:12
Finding

Hardcoded GM Authentication Token in Executable Scripts

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/test_account_apis.py:12
  • scripts/test_all_apis.py:19-21
  • scripts/test_all_premium_apis.py:12-16
  • scripts/test_financial_apis.py:22

Vulnerability Type: Hardcoded authentication credential
Risk Level: High

Vulnerable Code

scripts/test_account_apis.py:12

python
TOKEN = 'c2a347464c31056c84165dff766750fbf2ec67b4'

scripts/test_all_apis.py:19-21

python
# ============================
# !! 运行前请修改此 Token !!
# ============================
TOKEN = 'c2a347464c31056c84165dff766750fbf2ec67b4'

scripts/test_all_premium_apis.py:12-16

python
TOKEN = os.environ.get('GM_TOKEN', '')
if not TOKEN:
    TOKEN = 'c2a347464c31056c84165dff766750fbf2ec67b4'

set_token(TOKEN)

scripts/test_financial_apis.py:22

python
TOKEN = 'c2a347464c31056c84165dff766750fbf2ec67b4'

The scripts pass this value to authenticated SDK entry points:

python
if __name__ == '__main__':
    set_token(TOKEN)

Technical Analysis

The same 40-character GM token is embedded in four executable scripts. It is not merely presented as inert documentation: the scripts supply it to set_token() or run(), allowing it to be used for authenticated GM SDK requests.

The premium API test is particularly unsafe because it silently falls back to the embedded credential whenever GM_TOKEN is not set. As a result, executing the script may use another account's credential without the operator realizing it.

Secrets committed to source code can be recovered from distributed packages, source archives, caches, backups, forks, and repository history even after the current files are edited.

Attack Path

  1. An attacker obtains a copy of the project or reads its repository history.
  2. The attacker searches the source for token-like strings and extracts the embedded value.
  3. The a ...[truncated 945 chars]
Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed token immediately; deleting it from the current files is insufficient.

  2. Purge the credential from repository history, release archives, build artifacts, caches, and published packages.

  3. Replace every hardcoded value with mandatory runtime retrieval:

    python
    import os

TOKEN = os.environ.get('GM_TOKEN')
if not TOKEN:
    raise RuntimeError('GM_TOKEN must be set securely before execution')

  4. Remove all fallback credentials. Scripts must fail closed when authentication is unavailable.

  5. Store long-lived credentials in an operating-system credential manager or dedicated secret-management service rather than source files.

  6. Add secret scanning to pre-commit hooks and CI, using tools capable of detecting high-entropy strings and known token formats.

  7. Restrict tokens to the minimum required API permissions and use separate credentials for testing and live trading.

  8. Avoid printing any token content, including prefixes, because partial values can assist correlation and accidental disclosure investigations.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/run_strategy.py:50
Finding

Arbitrary Strategy Execution with the Complete Parent Environment

Content
View full analysis

Vulnerability Details

File Location: scripts/run_strategy.py:50-103
Vulnerability Type: Unsafe subprocess environment inheritance and unrestricted script execution
Risk Level: High

Vulnerable Code

python
# ---- 验证文件 ----
strategy_path = os.path.abspath(args.strategy)
if not os.path.exists(strategy_path):
    print(f'[ERROR] 策略文件不存在: {strategy_path}')
    sys.exit(1)

# ---- 构建子进程命令 ----
cmd = [sys.executable, strategy_path]

# 通过环境变量传递参数给策略文件的 __main__
env = os.environ.copy()
env['GM_RUN_MODE'] = args.mode
env['GM_TOKEN'] = args.token
if args.strategy_id:
    env['GM_STRATEGY_ID'] = args.strategy_id
env['GM_ACCOUNT_ID'] = account_id
if args.start:
    env['GM_BACKTEST_START'] = args.start
if args.end:
    env['GM_BACKTEST_END'] = args.end
if args.cash > 0:
    env['GM_INITIAL_CASH'] = str(args.cash)

# 切换工作目录到策略所在目录
cwd = os.path.dirname(strategy_path)

# ---- 执行策略 ----
try:
    proc = subprocess.run(
        cmd,
        cwd=cwd,
        env=env,
        check=False,
        capture_output=False,
    )

Technical Analysis

The runner accepts an arbitrary path through --strategy, converts it to an absolute path, checks only whether it exists, and executes it with the current Python interpreter. It does not verify that the target:

  • Is a regular Python file.
  • Resides in an approved strategy directory.
  • Was generated or reviewed by the Skill.
  • Has trusted ownership or safe permissions.

Although the subprocess invocation correctly uses an argument list rather than shell=True, the selected file is itself executable Python code. More importantly, os.environ.copy() gives that arbitrary code every environment variable available to the parent Agent process. The runner then adds the GM token and account identifier to that environment.

Consequently, an untrusted strategy can access unrelated cloud credentials, CI tok ...[truncated 1586 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace os.environ.copy() with a minimal allowlisted environment:

    python
    env = {
    'PATH': os.environ.get('PATH', ''),
    'PYTHONIOENCODING': 'utf-8',
    'GM_RUN_MODE': args.mode,
    'GM_TOKEN': args.token,
    'GM_ACCOUNT_ID': account_id,
}

  2. Add only the optional GM variables that are explicitly needed for the selected run.

  3. Require the strategy to be a regular .py file located under a canonical approved strategy directory:

    python
    approved_root = os.path.realpath(APPROVED_STRATEGY_DIRECTORY)
strategy_path = os.path.realpath(args.strategy)

if os.path.commonpath([approved_root, strategy_path]) != approved_root:
    raise ValueError('Strategy path is outside the approved directory')
if not os.path.isfile(strategy_path) or not strategy_path.endswith('.py'):
    raise ValueError('Strategy must be a regular Python file')

  4. Reject symlinks or resolve them before applying the directory restriction.

  5. Clearly warn users that a strategy is executable code and require confirmation before running externally supplied files.

  6. Run strategies in a sandbox, container, or restricted operating-system account without access to unrelated credentials or sensitive directories.

  7. Use a dedicated, minimally privileged GM token for backtesting and a separate credential for live trading.

  8. Require explicit confirmation before live mode and display the selected account without exposing secrets.

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:17
Finding

Unsafe Collection and Persistent Plaintext Storage of Account Tokens

Content
View full analysis

Vulnerability Details

File Locations:

  • README.md:17-21
  • references/15-user-guide.md:164-179

Vulnerability Type: Insecure secret collection and storage guidance
Risk Level: Medium

Vulnerable Content

README.md:17-21

markdown
### 2️⃣ 设置 Token

获取方式：掘金终端 → 系统设置 → 密钥管理 → 复制 Token

然后告诉我："我的 token 是 `xxxxx`"，我会自动保存。

references/15-user-guide.md:164-179

markdown
### 保存 Token

将 Token 写入环境变量，避免每次手动输入：

**Windows（PowerShell 临时设置）**：
```powershell
$env:GM_TOKEN = "你的token"

Windows（永久设置）：

powershell
[System.Environment]::SetEnvironmentVariable("GM_TOKEN", "你的token", "User")

💡 设置后重启 VS Code，WorkBuddy 就能自动读取

text

### Technical Analysis

The documentation directs users to disclose an account-equivalent token in an Agent conversation and states that the Agent will automatically save it. It does not identify where the secret will be stored, how it will be protected, who can read it, how long it will be retained, or how the user can delete it.

Conversational submission can place the token in chat histories, Agent traces, telemetry, debugging logs, or retained session data. Permanent user-level environment variables are also generally stored as plaintext configuration and are readable by processes running under the same user context.

Environment variables may additionally be inherited by child processes. This risk is directly amplified by `scripts/run_strategy.py`, which copies the complete parent environment into arbitrary strategy subprocesses.

### Attack Path

1. A user follows the README and submits the GM token directly in a conversation.
2. The token is retained in chat history, Agent logs, telemetry, or unspecified automatic storage.
3. Alternatively, the user permanently stores it in the user-level `GM_TOKEN` environment variable.
4. Another extension, process, diagnostic tool, child process, or user wit
...[truncated 593 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions asking users to paste credentials into Agent conversations.
  2. Replace conversational collection with a local hidden-input prompt or an operating-system credential manager.
  3. Clearly document where secrets are stored, their retention period, access controls, and the deletion procedure.
  4. Prefer short-lived, process-scoped credentials for temporary backtests.
  5. For persistent storage, use Windows Credential Manager, macOS Keychain, a Linux secret service, or an enterprise secret-management platform.
  6. Do not automatically save tokens without explicit, informed user consent.
  7. Prevent logs, exceptions, command histories, and console output from including complete or partial token values.
  8. Ensure child processes receive only explicitly required environment variables.
  9. Recommend token rotation after suspected disclosure and separate backtest credentials from live-trading credentials.

T08 · Insecure Dependencies

Warning
Location
README.md:11
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • README.md:11-15
  • references/15-user-guide.md:67

Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Content

README.md:11-15

markdown
- [**掘金终端**](https://www.myquant.cn) — 打开并登录
- **Python 3.8+** — 安装 `gm` SDK 包：
  ```bash
  pip install gm
  ```

references/15-user-guide.md:67

bash
pip install gm -U

Technical Analysis

The installation instructions retrieve the latest package named gm without pinning a reviewed version, verifying cryptographic hashes, or explicitly identifying a trusted package index. The -U instruction further permits silent replacement of an installed version with the latest published release.

Python package installation and later import can execute package-controlled code with the user's privileges. If the package name is confused with an unofficial package, the package index or maintainer account is compromised, or a malicious future release is published, users following these instructions may execute code that was never audited with this Skill.

The finding does not establish that the current gm package is malicious. The vulnerability is the lack of version and integrity controls in the documented dependency workflow.

Attack Path

  1. An attacker compromises the relevant package publication channel, publishes a malicious future release, or exploits package-source ambiguity.
  2. A user follows pip install gm or pip install gm -U.
  3. Pip resolves and installs the attacker-controlled or compromised release.
  4. Package installation hooks or subsequent from gm.api import * statements execute malicious code.
  5. The code runs with the installing user's permissions and can access the GM token and other locally available data.

Impact Assessment

A compromised dependency could obtain arbitrary code execution with the privile ...[truncated 461 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the SDK to a reviewed version:

    bash
    python -m pip install "gm==REVIEWED_VERSION"

  2. Use a requirements lockfile containing cryptographic hashes and install with hash enforcement:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. Explicitly identify the official package source and trusted index URL.

  4. Verify the publisher, package metadata, signatures where available, and release provenance before updating.

  5. Replace unconditional -U guidance with a controlled upgrade process that includes changelog review, testing, and security approval.

  6. Install dependencies inside an isolated virtual environment with minimal permissions.

  7. Add dependency scanning and software-composition analysis to CI.

  8. Maintain a tested compatibility matrix so users do not need to install an unspecified latest release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (228)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The file positions the skill as a general SDK expert yet includes standard templates and instructions for running backtest/live strategy logic through gm.api run() with environment-driven parameters. In the context of a trading skill, hidden transition from advice to execution is particularly dangerous because it can move from explanation to order placement or backtest execution with little user awareness.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.

md
| `18-stock-premium-apis.md` | 股票增值数据 API 完整文档（行业/板块/分红/龙虎榜/沪深港通/资金流向等） |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

This documentation exposes live order-placement and position-closing APIs, including order_close_all, with example code that could be copied directly into a trading strategy, but it provides no warning about real-money execution, liquidation risk, slippage, or the irreversible impact of destructive actions. In the context of an auto-loaded trading skill, omission of safety guidance materially increases the chance that a user or agent will trigger unintended live trades or flatten an entire portfolio.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_strategy.py (reported line 81)May include surrounding context.

python
cmd = [sys.executable, strategy_path]

    # 通过环境变量传递参数给策略文件的 __main__
    env = os.environ.copy()
    env['GM_RUN_MODE'] = args.mode
    env['GM_TOKEN'] = args.token
    if args.strategy_id:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hardcoded API token embeds a credential directly in source code, making it likely to leak through version control, logs, shared skill bundles, or screenshots. In a trading/quant SDK context, exposed credentials can allow unauthorized API access, data access, account misuse, and potentially order placement depending on token scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hardcoded API token is embedded directly in source and then partially echoed to stdout, which risks credential leakage through source control, logs, screenshots, or terminal history. Because this skill is meant to assist with SDK usage, users may copy the pattern and unintentionally expose production credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script contains a hardcoded fallback API token and automatically uses it when the GM_TOKEN environment variable is absent. Embedding live credentials in source code risks unauthorized API access, credential leakage through source control or logs, and unintended consumption of a paid data account.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Using embedded fallback credentials without explicit warning or consent causes the script to silently authenticate as whoever owns that token. In a quant/trading SDK context, this is especially risky because it may expose premium market data entitlements, incur charges, or normalize unsafe handling of sensitive API credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The line "用中文说话就能跑量化策略" presents Chinese as the required interaction language, and the rest of the README is written entirely in Chinese without stating that other languages are supported. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly instructs users to paste their account token into chat and states it will be automatically saved. That creates a real secret-handling vulnerability because chat channels, logs, transcripts, or downstream tooling may retain the token, enabling account misuse if exposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Telling users to provide their token directly in chat so the agent can save it is a direct insecure secret collection pattern. In this skill's context, the token appears to grant access to a trading/data platform, so exposure could lead to unauthorized API usage, account abuse, or access to sensitive financial data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README promises automatic strategy generation and execution, including running backtests, without clearly disclosing that files will be created and code/processes executed on the user's machine. This is dangerous because users may unknowingly authorize code execution from natural-language prompts, increasing the risk of unintended commands, unsafe file writes, or abuse through prompt manipulation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill clearly instructs the agent to generate and run local Python strategy scripts and to use environment variables/tokens, yet it declares no explicit tool scope or permissions. That mismatch can let a broadly auto-loaded skill reach shell/env-backed execution paths without transparent authorization boundaries, increasing the chance of unintended code execution or access to sensitive runtime data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is extremely broad and includes many generic finance and SDK terms, so the skill may auto-load in ordinary discussion contexts. Because the skill also contains execution guidance and trading-related actions, over-triggering increases the chance that privileged behavior appears in situations where the user only wanted information, making the context more dangerous than a narrow, explicitly invoked trading tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is framed as a natural-language strategy assistant, but it explicitly instructs the agent to execute local scripts for backtest or live runs. That scope expansion matters because users invoking a help skill may unintentionally trigger code execution pathways, and in this domain execution can interact with credentials, local files, and trading systems.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document says the agent must ask the user for strategy_id and must not silently invent one, yet the supplied template falls back to 'my_strategy'. In an execution-oriented trading context, silent defaults can cause runs to be misattributed, overwrite or confuse persisted strategy records, and bypass an intended user-confirmation checkpoint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

L835 明确写明 log(msg, source) 是普通函数，“不是 logger 对象”，并要求不要用 log.info()。然而标准模板在 L125、L139、L208 以及后续连接事件示例 L395-L404 都使用了 log.info() 或 log.error()，与其自身“实测验证必须遵守”的说明直接相反。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill-facing document is written in Chinese and does not indicate that other languages are supported or that the user can opt into this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.