ClawHub
Back to skill

Security audit

longbridge-stock

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Longbridge stock and account-query purpose, but it needs review because it handles brokerage credentials and account data with broad activation, persistent plaintext config, and unvalidated custom API endpoints.

Install only if you intentionally want Codex to use Longbridge credentials for quotes, balances, and positions. Use a dedicated low-privilege token if available, store the config outside shared workspaces with restrictive permissions, do not commit it, avoid custom endpoints unless you fully trust them, and ask for confirmation before account balance or position queries.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party SDK Installation

Content
View full analysis
Remediation
View remediation
``` 2. Generate and record cryptographic hashes for the approved distribution artifacts. 3. Install dependencies using hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review dependency updates before changing the lock file. 5. Use a virtual environment and avoid installing the package with elevated privileges. 6. Update both `SKILL.md` and `references/config.md` so they reference the same locked installation procedure. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/quote.py:54
Finding

Unvalidated Custom API Endpoints May Redirect Authenticated Financial API Traffic

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is security-relevant because the skill's public description emphasizes harmless stock/account queries while the documented operational behavior includes searching standard local paths and environment configuration for API credentials. Undisclosed credential access reduces informed consent and can cause the skill to handle sensitive secrets and account data in ways users and orchestrators did not expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This mismatch is security-relevant because the skill's public description emphasizes harmless stock/account queries while the documented operational behavior includes searching standard local paths and environment configuration for API credentials. Undisclosed credential access reduces informed consent and can cause the skill to handle sensitive secrets and account data in ways users and orchestrators did not expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch is security-relevant because the skill's public description emphasizes harmless stock/account queries while the documented operational behavior includes searching standard local paths and environment configuration for API credentials. Undisclosed credential access reduces informed consent and can cause the skill to handle sensitive secrets and account data in ways users and orchestrators did not expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This mismatch is security-relevant because the skill's public description emphasizes harmless stock/account queries while the documented operational behavior includes searching standard local paths and environment configuration for API credentials. Undisclosed credential access reduces informed consent and can cause the skill to handle sensitive secrets and account data in ways users and orchestrators did not expect.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 29)May include surrounding context.

bash
LONGPORT_APP_KEY=<你的App Key>
LONGPORT_APP_SECRET=<你的App Secret>
LONGPORT_ACCESS_TOKEN=<你的Access Token>
LONGPORT_REGION=cn           # cn = 中国大陆, hk = 香港, us = 美国
LONGPORT_HTTP_URL=https://openapi.longportapp.cn
LONGPORT_QUOTE_WS_URL=wss://openapi-quote.longportapp.cn

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 40)May include surrounding context.

bash
LONGPORT_APP_KEY=<你的App Key>
LONGPORT_APP_SECRET=<你的App Secret>
LONGPORT_ACCESS_TOKEN=<你的Access Token>
LONGPORT_REGION=cn           # cn = 中国大陆, hk = 香港, us = 美国
LONGPORT_HTTP_URL=https://openapi.longportapp.cn
LONGPORT_QUOTE_WS_URL=wss://openapi-quote.longportapp.cn

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/longbridge_config.py (reported line 119)May include surrounding context.

python
print("───")
    print("LONGPORT_APP_KEY=<你的App Key>")
    print("LONGPORT_APP_SECRET=<你的App Secret>")
    print("LONGPORT_ACCESS_TOKEN=<你的Access Token>")
    print("LONGPORT_REGION=cn")
    print("LONGPORT_HTTP_URL=https://openapi.longportapp.cn")
    print("LONGPORT_QUOTE_WS_URL=wss://openapi-quote.longportapp.cn")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents behavior that relies on reading environment variables and local configuration files containing brokerage API credentials, but it does not declare any tool scope or permissions boundary. That creates an authorization gap: an orchestrator or reviewer cannot clearly constrain or audit sensitive file/env access before the skill is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger text is very broad, instructing use for general stock-price, market-data, and portfolio-value questions even when the user does not explicitly request Longbridge. In a brokerage-connected skill, overbroad activation can unnecessarily access sensitive account context or encourage account-linked operations when a generic market-data answer would suffice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill can access account balance and portfolio positions, which are sensitive financial data, yet the documentation provides no warning or consent guidance. Without clear disclosure, users may not realize that invoking the skill could expose brokerage balances, holdings, or buying power to the agent workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill instructs storing long-lived API secrets in a persistent plaintext config file across multiple common locations, including workspace root and home directories. Persistent credential storage increases the chance of accidental disclosure to other skills, users, processes, or source-control mistakes, especially because these credentials can provide access to sensitive brokerage data and trading-related APIs.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
## Configuration

Create `.longbridge_config` in one of these locations (priority order):

1. Environment variable: `LONGBRIDGE_CONFIG=/path/to/.longbridge_config`
2. `<skill-dir>/.longbridge_config`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file instructs users to place LONGPORT_APP_SECRET and LONGPORT_ACCESS_TOKEN into configuration files, including locations inside the skill or workspace, but it does not warn that these are sensitive credentials. Because the file is a markdown reference and describes behavior that could affect user privacy and account security, it should explicitly caution users not to commit or expose these secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The code loads sensitive credentials (LONGPORT_APP_KEY, LONGPORT_APP_SECRET, LONGPORT_ACCESS_TOKEN) and uses them to create a remote trading context, which will transmit data to the brokerage API. Although there are progress prints, there is no disclosure that sensitive financial credentials and account information are being used and sent over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code reads a configuration file containing LONGPORT_APP_SECRET and LONGPORT_ACCESS_TOKEN, which are sensitive credentials. While it prints errors and setup instructions, it does not include any explicit disclosure in the function docstring or comments warning that the module loads and handles secrets from disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The sample configuration hard-codes the region to cn and uses China-specific API endpoints, which implies a fixed locale/region setting. The file does not offer a user choice or explain that this is a region-specific example, creating a potential language/locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The entire user-facing documentation is presented only in Chinese, with no indication that alternative languages are available or that Chinese is a required locale for this skill. The policy requires avoiding forced language constraints unless users are given a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all instructions and examples only in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language is offered. The content does not state that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's docstrings and all user-facing messages are written in Chinese, which imposes a specific language on users without any opt-in or explanation of a locale-specific scope. This is a natural-language policy concern because the skill does not indicate that Chinese is required or provide an alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The help text instructs users to set LONGPORT_REGION=cn, which imposes a locale/region setting in natural-language guidance. The file does not indicate that this is optional, user-selectable, or justified as a region-specific skill constraint.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/positions.py (reported line 92)May include surrounding context.

python
pos_dict = {}
                            for attr in dir(pos):
                                if not attr.startswith('_'):
                                    pos_dict[attr] = getattr(pos, attr)

                            # 检查是否有 symbol
                            if pos_dict.get('symbol'):