A股量化选股助手

• Outcome: Review
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This stock-screening skill has a coherent purpose, but it handles paid API tokens and financial-query data in ways that need review before installation.

Install only if you trust the provider and accept sending your A-share queries and API token to its cloud service. Avoid storing the token in ~/.bashrc, avoid reused or valuable credentials, and prefer waiting for HTTPS-only API traffic with clearer privacy and billing disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tainted flow: 'API_BASE' from os.environ.get (line 23, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

"User-Agent": "OpenClaw-Skill/1.0"
    }
    try:
        resp = requests.get(
            f"{API_BASE}{endpoint}",
            headers=headers,
            params=params or {},

• Confidence: 96% confidence
• Finding: The request target is derived from the environment-controlled API_BASE and the script unconditionally sends the X-Token header to that destination. This creates an SSRF/exfiltration path where anyone who can influence YUFENG_QUANT_API can redirect authenticated requests, steal the token, or force connections to unexpected internal or external services.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read an API token from the environment and pass it to an external service, which is credential-handling behavior. While a token is relevant to the stock-screening function, the risk is real because the behavior is not tightly constrained or permission-gated, and any skill that prompts credential access can expand secret exposure if invoked unexpectedly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states the skill sends requests to a remote cloud engine and requires a token, but it does not clearly disclose what user data, stock queries, or metadata may be transmitted off-device. In an agent skill context, undisclosed external network access can expose sensitive prompts, usage patterns, or proprietary trading interests to a third party, especially when the endpoint is a direct IP address rather than a well-identified service with trust documentation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match many common investing questions, increasing the chance this skill is invoked when the user did not intend to use an external paid cloud screener. In context, unintended invocation matters because it may consume paid tokens and transmit user queries to a third-party service without clear opt-in.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill does not clearly warn users that their token and stock-query inputs will be sent to a cloud API, undermining informed consent and data transparency. In this context, the omission is more serious because the service is third-party, uses paid tokens, and involves financial-interest queries that users may reasonably expect to stay local unless told otherwise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer asks for an API token and appends it directly to ~/.bashrc, causing the secret to be stored in plaintext in a broadly readable and easy-to-leak location. Shell startup files are commonly backed up, shared, inspected for debugging, or exposed through local compromise, so this weakens credential confidentiality even if it is not overtly malicious.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits an authentication token to a third-party remote API via the X-Token header without any explicit user-facing disclosure at the point of use. In a skill context, this is sensitive because users or calling agents may not realize a local token is being sent off-box to an external service for every action.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The default API endpoint uses plain HTTP, so the authentication token and all request/response data can be intercepted or modified by any network attacker between the client and server. Because this skill handles a reusable API token, lack of TLS directly enables credential theft and response tampering.

Static analysis

No suspicious patterns detected.