Concrete Stock Daily Reporter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill can generate stock reports, but its sending workflow transmits them to a fixed Feishu recipient and includes persistent scheduling guidance without enough user control.

Review carefully before installing. Do not use the sending or scheduling script unless you replace the Feishu recipient with your own verified destination, understand that your watchlist and report contents leave the machine, and are comfortable with recurring cron execution. Market data integrity is also weakened by disabled TLS verification and plaintext HTTP.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_report.sh:24

Finding

Stock reports are transmitted to a hard-coded Feishu recipient

Content

View full analysis

> /tmp/stock_report.log 2>&1 ``` ### Technical Analysis The script always sends generated reports to the package-defined Feishu identifier `ou_624ec10057e782149ded8bc7040ea7b9`. The user cannot select or verify the destination through an argument or documented configuration setting. The generated message contains user-supplied stock codes and names, current market information, and indicators derived from the watchlist. Consequently, invoking the sending script grants the package author-selected recipient access to information about the user's investment interests. The Skill documentation says that the report is sent through Feishu but does not disclose that the recipient is fixed. The issue becomes more significant when combined with scheduled execution because reports may be transmitted repeatedly without renewed user review. ### Attack Path 1. A user supplies a stock watchlist to `send_report.sh`. 2. The script passes the watchlist to `daily_report.py`. 3. The Python script incorporates the watchlist and derived market information into `REPORT`. 4. `send_report.sh` invokes the locally authenticated OpenClaw CLI. 5. OpenClaw sends the complete report to the hard-coded Feishu recipient. 6. The recipient obtains the user's report without the destination being explicitly selected at invocation time. No shell-command injection was identified in this path because the report is passed as a quoted argument. The vulnerability is the undisclosed, fixed recipient rather than argument execution. ### Impact Assessment Successful exploitation does not grant operating-system privileges. It abuses the user's existing OpenClaw messaging authorization to disclose repo ...[truncated 364 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_report.py:63

Finding

TLS certificate and hostname verification are disabled for Sina API requests

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_report.py:107

Finding

Eastmoney market data is retrieved over plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more serious because the skill apparently sends messages to a fixed Feishu destination, writes local logs, and uses an external messaging tool without making those details explicit in the declaration. Hidden outbound messaging and hardcoded recipients can cause unauthorized disclosure of generated content or operational data to unintended parties.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more serious because the skill apparently sends messages to a fixed Feishu destination, writes local logs, and uses an external messaging tool without making those details explicit in the declaration. Hidden outbound messaging and hardcoded recipients can cause unauthorized disclosure of generated content or operational data to unintended parties.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

| `daily_report.py` | 生成报告内容（行情+KDJ），输出纯文本 |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

| `daily_report.py` | 生成报告内容（行情+KDJ），输出纯文本 |

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation declares no explicit tool scope or permission boundaries even though it instructs use of external network resources. In an agent setting, undeclared network capability weakens policy enforcement and user visibility, making it easier for the skill to access external services without clear consent or sandbox expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says the skill triggers when a user needs to generate a stock daily report, query watchlist quotes, KDJ indicators, or set scheduled stock reports, but it does not define specific invocation phrases, scope limits, or exclusion conditions. This ambiguity could cause unintended invocation for general stock-related requests that may not actually require this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill's behavior and usage in a single locale without indicating that language choice is optional. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless it is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs users to inspect and modify crontab, which creates persistence beyond the current session. Persistent scheduled execution can continue making network requests and sending messages automatically, potentially causing ongoing data disclosure, spam, or misuse if configured without strong consent and visibility.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

bash

# 查看当前定时任务
crontab -l

# 编辑定时任务（每天08:30发送）
crontab -e

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The explicit crontab entry establishes a recurring task that runs a shell script daily and appends output to a local log file. In an agent environment, this is a classic persistence mechanism: it survives the immediate interaction and can repeatedly trigger outbound communication or data processing without fresh user intent.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

crontab -l

编辑定时任务（每天08:30发送）

crontab -e

添加：30 8 * * * /root/.openclaw/workspace/skills/stock-daily-report/scripts/send_report.sh >> /tmp/stock_report.log 2>&1

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script unconditionally sends generated content to a hard-coded Feishu recipient, creating a fixed outbound data flow that the user does not control. In a skill driven by user-supplied stock lists, this can leak user requests or generated report contents to an unintended third party and is riskier because the destination account is embedded directly in code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits the full generated report to an external Feishu account without any user-facing notice, consent, or indication that data leaves the local environment. Even if the content is only stock selections, it may reveal user interests, holdings, or trading behavior, making the undisclosed exfiltration concerning in this skill context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring, CLI help, error messages, and generated report content are all hard-coded in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale constraint that should be surfaced or made configurable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code constructs outbound HTTP requests using stock codes derived from the user's input and sends them to Sina and Eastmoney services. Although network access is central to the script's purpose, there is no explicit disclosure in user-facing output or usage text that the provided watchlist symbols will be transmitted to external providers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The docstring at L098 says '获取KDJ指标 - 使用东方财富API', which implies the function obtains KDJ directly from the API. In reality, the API call at L108-L115 fetches K-line history and the function derives RSV/K/D/J itself at L120-L146. This is an intent/documentation mismatch rather than a security boundary issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The KDJ lookup performs another outbound request to a separate third-party endpoint using the stock code. The script does not warn users that their selected securities will be shared with an additional external service, which is relevant privacy/transparency information for a reporting tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script's natural-language interface elements, including description, usage, example, and error messages, are presented solely in Chinese. This forces a specific language for users without offering a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/daily_report.py:57