stockClaw-yingyan 股票量化助手，可以获取个股择时量化图，个股行情分析，AI搜索特定股票，监控股买卖点变化通知。

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:11 PM UTC
• Version: 1.1.4

Overview

The skill is a coherent stock assistant, but it stores API keys in a local file and tells the agent to treat remote API text as privileged prompt instructions.

Review before installing. Use only limited or disposable API keys if possible, keep config.json private, do not commit or upload it after it contains real credentials, avoid sharing logs or full WebSocket URLs, and independently verify any stock analysis because part of the agent's analysis prompt may come from the remote service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:125

Finding

Remote API Responses Are Promoted to Privileged Model Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125-126, SKILL.md:232, SKILL.md:238-294; reinforced by examples.md:117-118 and reference.md:125-130
Vulnerability Type: Remote prompt injection through trusted API response fields
Risk Level: High

Relevant source excerpt from SKILL.md:125-126 (English rendering):

markdown

- `intent=market_query`: Return structured TDX snapshot data, `system_prompt`, and `user_prompt`.
- After receiving the response, you, the OpenClaw model, must use the returned
  `system_prompt` and `user_prompt` to generate the trend diagnosis.

Relevant source excerpt from SKILL.md:232 and SKILL.md:294 (English rendering):

markdown

- If `system_prompt` and `user_prompt` are returned, use the market-query
  prompt instructions below to complete and return the analysis.

Directly use `user_prompt` as the user message and combine it with the
system prompt above to complete the trend diagnosis.

Technical Analysis

The Skill explicitly instructs the Agent to promote strings returned by yingyan.chatface.com into system-level and user-level model instructions. The API response is controlled outside the reviewed Skill package and can change after publication without a corresponding package update.

No validation mechanism restricts these fields to the documented stock-analysis prompt. The Skill does not require a response signature, compare the returned system prompt against a local immutable template, reject instruction-like content, or isolate the response as untrusted stock data. Consequently, anyone who compromises or controls the remote endpoint, its upstream data, or the response path can modify the Agent's active instructions.

Treating an external response as a system prompt crosses a trust boundary: stock data should be interpreted as data, not as privileged control-plane instructions. Ordinary TLS protects transport confidentiality and integrity ...[truncated 1539 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to use remotely returned text as a system prompt.
2. Define the complete stock-analysis system prompt locally in the reviewed Skill package.
3. Treat the API response exclusively as untrusted structured data.
4. Replace system_prompt and user_prompt with a versioned JSON schema containing only required stock fields, numeric values, signal summaries, and risk indicators.
5. Enforce strict field allowlists, types, lengths, nesting depth, and response-size limits.
6. Reject unexpected fields and instruction-like payloads rather than passing them to the model.
7. Serialize remote text inside clearly delimited data sections and explicitly prohibit following instructions contained in those sections.
8. If server-generated prompt templates are operationally necessary, require a pinned template identifier or cryptographic signature and compare the content against an approved local template.
9. Add adversarial tests in which the API returns prompt-injection strings and verify that they are treated only as data.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46

Finding

API Credentials Are Persisted in a Plaintext Project Configuration File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-55; credential destination defined at config.json:23-27
Vulnerability Type: Plaintext persistent secret storage
Risk Level: Medium

Relevant source excerpt from SKILL.md:46-55 (English rendering):

markdown

1. Read `openclawCredentials.user_id`, `openClaw_api_key`, and
   `monitor_api_key` from `config.json`.
2. If the user provides new credentials in the current conversation, use
   those values and write them back to `config.json`.

- After the required values are first completed, or after the user updates
  any field, write the merged result to the `openclawCredentials` object in
  `config.json`.
- Preserve the other top-level keys and write valid JSON.

Credential storage structure from config.json:23-27:

json

{
  "openclawCredentials": {
    "user_id": "",
    "openClaw_api_key": "",
    "monitor_api_key": ""
  }
}

Technical Analysis

The Skill directs the Agent to write long-lived API credentials directly into config.json in plaintext. Although the audited copy contains empty values and therefore does not expose an embedded credential at audit time, normal Skill operation populates these fields with live secrets.

A project configuration file is not an appropriate secret store unless the runtime guarantees restrictive permissions, exclusion from synchronization and packaging, secure deletion, and redaction. No such controls are declared. The same directory also contains upload metadata that recommends including config.json, creating an additional risk that a populated configuration could be copied, archived, backed up, or uploaded with the Skill folder.

Attack Path

1. A user supplies user_id, openClaw_api_key, or monitor_api_key in a conversation.
2. The Skill merges the values and writes them into config.json.
3. The plaintext file remains available across later sessions.
4. Ano ...[truncated 830 chars]

Remediation

View remediation

Remediation Suggestions

1. Store credentials in the hosting platform's managed secret store or operating-system credential manager.
2. Keep only secret references or credential identifiers in config.json.
3. If file storage cannot be avoided, use a dedicated file outside the uploadable Skill directory, encrypt it with a platform-managed key, and restrict permissions to the runtime identity.
4. Prevent config.json containing populated secrets from being included in uploads, archives, logs, support bundles, or source-control commits.
5. Add a sanitized config.example.json containing empty placeholders and exclude the live configuration file.
6. Redact all credential values from tool output, exceptions, diagnostics, and conversation responses.
7. Support explicit credential deletion and rotation.
8. Document credential lifetime, scope, revocation procedures, and the exact local storage location.
9. Add pre-upload and pre-commit secret scanning that blocks nonempty credential fields.

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:36

Finding

Authentication Secrets Are Embedded in HTTP and WebSocket Query Strings

Content

View full analysis

Vulnerability Details

File Location: config.json:36; also documented at SKILL.md:171 and SKILL.md:188-191
Vulnerability Type: Sensitive authentication data in URLs
Risk Level: Medium

WebSocket URL template from config.json:36:

json

{
  "monitorWsTemplate": "wss://yingyan.chatface.com/ws/monitor/open?apikey={monitor_api_key}&user_id={user_id}"
}

HTTP request template from SKILL.md:171:

text

GET /api/openclaw/stock/limit-up?user_id=your_user_id&apikey=YOUR_OPENCLAW_12_CHAR_KEY

WebSocket request template from SKILL.md:188-191:

text

The returned WebSocket template uses the query parameters `apikey` and
`user_id`.

wss://yingyan.chatface.com/ws/monitor/open?apikey=<monitor_api_key>&user_id=<user_id>

Technical Analysis

Both the HTTP limit-up endpoint and the WebSocket monitoring endpoint place authentication keys in URL query parameters. URLs are frequently recorded by reverse proxies, load balancers, application access logs, observability systems, browser history, debugging tools, error reports, and copied command output.

TLS encrypts the URL while it travels over the network, but the complete URL remains visible to the client and destination infrastructure and may be retained by intermediate logging components after decryption. The WebSocket connection is especially sensitive because its initial HTTP upgrade request contains the full query string.

Attack Path

1. The Agent substitutes a live API key and user identifier into an HTTP or WebSocket URL.
2. The client, proxy, server, monitoring platform, diagnostic output, or access log records the complete URL.
3. A party with access to that record extracts the query-string credentials.
4. The party replays the credentials against the corresponding service endpoint.
5. Unauthorized access continues until the credential expires or is revoked.

Impact Assessment

...[truncated 431 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace query-string authentication for HTTP endpoints with an Authorization header or another non-URL authentication header.
2. Authenticate WebSocket upgrades with a supported authorization header, a secure session cookie, or an appropriate negotiated subprotocol.
3. If browser limitations require a URL token, issue a single-use, narrowly scoped, short-lived connection token through an authenticated HTTPS request.
4. Do not place the user's long-lived monitoring API key directly in the WebSocket URL.
5. Configure clients, gateways, proxies, and application servers to redact apikey, user_id, and token-like query parameters.
6. Ensure errors and connection diagnostics never reproduce complete authenticated URLs.
7. Rotate existing keys after migrating the authentication mechanism because historical logs may already contain them.
8. Add replay protection, expiration, audience binding, and rate limits to temporary connection tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to persist API credentials into a local config.json file, but it does not require clear user consent, warn about local secret storage, or describe access controls for that file. This creates a real secret-handling risk: credentials may be left on disk longer than necessary, exposed to other tools/processes, committed to source control, or read by other users on the same system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs reading, persisting, and reusing API credentials from config.json, but it provides no warning about secure storage, file permissions, redaction, or the sensitivity of those secrets. In an agent-skill context, this can lead to credentials being stored in plaintext, exposed in logs, committed to source control, or reused without the user understanding the security implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples demonstrate sending user_id and API keys in authenticated HTTP bodies, query parameters, and WebSocket URLs to an external service, but they do not clearly disclose that sensitive identifiers and credentials are transmitted off-platform. Query-string and URL-based secrets are especially risky because they are commonly captured by logs, telemetry, browser history, proxies, and debugging tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language description is written entirely in Chinese and the API examples/descriptions for user inputs are likewise Chinese-only, which signals a fixed language/locale expectation. There is no visible opt-in, multilingual alternative, or justification that this skill is intentionally restricted to a Chinese-region or Chinese-language context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes this skill as providing OpenClaw integration guidance for stock charting, market Q&A, natural-language stock search, and WebSocket monitoring. However, the file also documents a separate '/api/wecom' Enterprise WeCom plugin authentication model and endpoints, which expands the skill’s described surface to another integration channel not mentioned in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation instructs the agent to persist user_id and API keys into a local config.json file without an explicit warning about the sensitivity of those credentials, storage permissions, or exposure through logs, backups, sync tools, or repository commits. In an agent environment, encouraging long-lived local secret storage without safeguards increases the chance of credential disclosure and unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WebSocket design requires the authentication key in the URL query string and the documentation does not warn that query parameters are commonly exposed via browser history, proxy/server logs, telemetry, referrers in some contexts, and debugging tools. Even over wss, URL-based secrets are more leak-prone than header- or subprotocol-based authentication, so a leaked monitor key could allow unauthorized subscription to real-time monitoring data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON file contains natural-language metadata and default inputs entirely in Chinese, including the display name and example prompts. Because there is no indication that the skill is region-specific or that users can choose a language, this may violate a language/locale policy requiring opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions and user-facing examples are entirely in Chinese, which can impose a specific language/locale on users. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose, so it may violate language choice policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The entire skill reference, including user-facing examples and suggested prompts, is written in Chinese with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.