Security audit

股票量化助手，可以获取个股择时量化图，个股行情分析，监控股买卖点变化通知。

Security checks for vulnerabilities and agentic risk

Overview

This stock assistant appears purpose-built, but it stores API keys in a risky plaintext config file and tells the agent to obey prompts returned by a remote service.

Install only if you trust yingyan.chatface.com and are comfortable with the agent saving reusable API keys in the skill folder. Avoid committing, uploading, or sharing a populated config.json; rotate keys if they may have been exposed. Treat remote returned prompts as untrusted data unless the skill is revised to keep system instructions local and parse only structured stock fields.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:125
Finding: Remote API Responses Are Executed as Agent-Level Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: config.json:23
Finding: API Credentials Are Persisted in a Plaintext Project Configuration File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:171
Finding: Authentication Secrets Are Transmitted in URL Query Parameters
Content: View full analysis
&user_id= ``` `config.json:36` embeds the same credential-bearing URL template in project configuration: ```json "monitorWsTemplate": "wss://yingyan.chatface.com/ws/monitor/open?apikey={monitor_api_key}&user_id={user_id}" ``` The remotely returned template documented in `reference.md:418` has the same design: ```json "ws_url_template": "wss://yingyan.chatface.com/ws/monitor/open?apikey={apikey}&user_id={user_id}", ``` ### Technical Analysis Authentication secrets are included directly in HTTP and WebSocket query parameters. Although HTTPS and WSS protect the URL while it is transmitted over the network, they do not prevent the complete URL from being recorded by the client, reverse proxy, application server, access logs, monitoring infrastructure, crash reports, browser history, or troubleshooting output. Query parameters are consequently unsuitable for reusable API secrets. The WebSocket case is particularly sensitive because connection URLs are frequently logged during handshake diagnostics and reconnection attempts. ### Attack Path 1. The Agent substitutes a real API key and user ID into one of the documented URL templates. 2. A client library, proxy, server, monitoring product, or diagnostic message records the complete URL. 3. A user or process with access to those records extracts the `apikey` and `user_id` values. 4. The attacker replays the exposed cre ...[truncated 742 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to persist user_id and API keys, including updated credentials, into config.json and then reuse them automatically. Persisting live credentials in a plain configuration file materially increases the chance of credential theft through local file access, repository inclusion, accidental upload, backup leakage, or cross-session exposure, which could enable unauthorized API use and account abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing instructions and prompt text exclusively in Chinese, including required credential prompts and success/failure messaging. Under the policy rule for language/locale constraints, forcing a single language without offering user choice or documenting a justified region-specific requirement is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON file includes natural-language strings such as the display name and update log entirely in Chinese, but it does not document that the skill is Chinese-only or offer any language/locale opt-in. Under the policy rule, forcing a specific language without user choice or clear justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to persist API credentials in config.json and send them to remote HTTP endpoints, but it does not warn that these are sensitive secrets that may be stored in plaintext, retained locally, or disclosed through logs, backups, or version control. In this context, the omission increases the risk of credential leakage and unintended transmission of account-linked authentication data to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The WebSocket monitoring flow tells users to embed monitor_api_key and user_id in a persistent connection URL, but omits a warning that long-lived authenticated connections can expose secrets in client logs, browser history, proxy logs, and continuously reveal account-linked monitoring activity. Because this feature is designed for real-time signal streaming, the missing disclosure is more dangerous than a one-off request: it can create ongoing visibility into a user's monitored assets and account behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes this skill as providing OpenClaw integration for stock charts, stock Q&A, natural-language stock search, and WebSocket monitoring. However, this file also documents a distinct /api/wecom surface for Enterprise WeCom usage with different authentication conventions, which expands the documented behavior beyond the OpenClaw-only purpose stated in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation tells the agent to write user-provided API credentials into config.json for later reuse without an explicit warning about persistence, local storage exposure, access controls, or rotation. This creates a real risk of inadvertent secret retention and disclosure, especially in shared workspaces, exported skill bundles, logs, backups, or environments where config files are readable by other processes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Natural-language instructions, prompts, and expected user interactions are all presented in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into another language. This may violate a language/locale policy when no explicit justification or user choice is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The OpenAPI metadata is written entirely in Chinese and describes request usage in a way that implicitly assumes Chinese-language operation, while the file does not offer any language or locale choice. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.