Industry Research v1.3.2

• Outcome: Review
• Latest audit: Jul 3, 2026 · 6:57 PM UTC
• Version: 1.3.2

Overview

This is a plausible market-research skill, but it needs review because it explicitly works around disabled platform search controls and handles external queries, API keys, and local archives with limited safeguards.

Review before installing. Use it only with non-sensitive research queries, avoid running the API-key checker in logged or shared sessions, and periodically inspect or delete archives and reports under ~/.openclaw. The publisher should remove the web_search-bypass workflow, stop printing key prefixes, and add clear privacy and retention documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and documents environment access, local file read/write, and unrestricted network use without declaring permissions or user-facing consent boundaries. In this context, those capabilities are material because the skill also archives data locally and uses external search/data providers, so the undeclared scope can lead to unexpected data exposure or persistence.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond industry research and includes checking/printing configured API keys, reading and writing local archive content, and generating local HTML reports. This mismatch is dangerous because users may invoke a research skill expecting only market analysis, while the implementation can expose secrets and persist or process local data outside the declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The README advertises a capability to apply a skill_workshop proposal, which is outside the stated purpose of an industry research skill. Even though this is only documentation, it normalizes a privileged workflow action that could mislead an agent or operator into approving or invoking unrelated changes, creating scope creep and potential unauthorized modification risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly frames Bocha/Bing integrations as a way to bypass disabled platform search controls. That is dangerous because it encourages deliberate circumvention of governance and monitoring layers that may exist to prevent unsafe browsing, sensitive query leakage, or policy violations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The workflow directs the agent to use direct-search scripts for arbitrary '查 XX' requests when standard search is disabled, normalizing control evasion as operational behavior. This increases the chance of unreviewed outbound requests, policy bypass, and sending sensitive user prompts or internal context to third-party services.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module persistently writes user-provided research content, summaries, tags, and file references into a local archive under the user's home directory. In a research/reporting skill, this expands behavior from transient analysis to long-term data retention, which can unintentionally store sensitive or proprietary information without explicit user consent, retention controls, or redaction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The report presents conflicting financial and technical metrics for the highlighted stock between the detailed section and the later '关键 findings' summary, which can mislead users about valuation, market cap, and indicators. In an investment-research skill, data integrity is security-relevant because downstream users or agents may rely on these figures for decisions, automation, or redistribution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes sending arbitrary research queries to external providers without a clear warning that user inputs may be transmitted to Bocha, Bing, Tencent, Eastmoney, Akshare, YFinance, and similar services. This is dangerous because users may include proprietary, trading, or sensitive context in prompts that is then silently disclosed to third parties.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: Archive operations store research content locally, but the skill text does not clearly warn users that outputs, summaries, and tags may persist on disk. This matters because research notes can contain sensitive investment theses, client data, or proprietary observations that remain readable later by other local processes or users.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The function transmits the supplied query string to a third-party search API without any user-facing disclosure or consent prompt. In a research skill, users may enter sensitive company names, investment theses, or proprietary topics, so silent external transmission can create privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script enumerates API key environment variables and prints a recognizable prefix of any configured secret. Even partial secret disclosure increases exposure by confirming which providers are in use and leaking enough material to aid correlation, debugging log leakage, or targeted credential attacks if output is captured in terminals, CI logs, screenshots, or shared sessions. In this skill context, the risk is somewhat elevated because the skill appears to rely on many third-party search/data providers, so this helper may be run in multi-user or hosted agent environments where console output is retained.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The script fetches market data over plain HTTP from the Tencent endpoint, which allows a network attacker to tamper with responses or observe traffic in transit. In this test/research context the data is public and no credentials are sent, so the impact is limited to integrity and reliability issues such as poisoned analysis output or misleading debugging results.

Ssd 1

High

• Confidence: 99% confidence
• Finding: The skill text openly presents search integrations as a mechanism to bypass disabled platform search controls, which is a strong indicator of intentional policy evasion. In a skill with broad external connectivity, this undermines security boundaries and can facilitate unmonitored browsing or data exfiltration.

Ssd 1

High

• Confidence: 97% confidence
• Finding: The documented workflow explicitly replaces approved web_search with CLI/direct-access methods, which is a concrete instruction to work around disabled functionality. This is dangerous because it defeats intended safety controls and can cause the agent to reach external systems through unreviewed channels.

Ssd 1

High

• Confidence: 99% confidence
• Finding: The upgrade history normalizes circumvention of gateway-level search restrictions through direct external access and even describes LLM estimation as a final fallback. That creates a hazardous precedent: safety restrictions are treated as obstacles to defeat rather than hard boundaries to respect.

External Transmission

Medium

• Category: Data Exfiltration

Content

"Content-Type": "application/json",
    }
    t0 = time.time()
    r = requests.post(url, json=payload, headers=headers, timeout=15)
    r.raise_for_status()
    data = r.json()
    elapsed = time.time() - t0

• Confidence: 82% confidence
• Finding: The code sends user-provided search terms and authentication metadata to an external web service. In this skill's context, research queries may contain sensitive business, trading, or investigative information, so third-party transmission meaningfully increases confidentiality and compliance risk even though it appears intended functionality.

Static analysis

No suspicious patterns detected.