ClawHub
Back to skill

Security audit

Ifind Mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent iFinD financial-data connector, but users should protect the API token and review the third-party mcporter install before using it.

Before installing, verify the mcporter package source, consider pinning a reviewed version, and avoid running install commands with unnecessary privileges. Treat the iFinD bearer token as a secret: store ~/.openclaw/mcporter.json with owner-only permissions, do not commit or share it, and revoke or rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global npm Dependency with Access to Authentication Credentials

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local installation with a committed lockfile over a global installation. 3. Use `npm ci` with a reviewed `package-lock.json` so dependency resolution is reproducible. 4. Verify package provenance, publisher identity, and registry source before installation. 5. Where supported, verify package signatures or integrity hashes and disable unnecessary lifecycle scripts. 6. Periodically review and deliberately update the pinned package and its transitive dependencies after security testing. 7. Run the client with the least-privileged account necessary and restrict its filesystem access to reduce the effect of a supply-chain compromise. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:27
Finding

Bearer Token Configuration Created Without Explicit Permission Hardening

Content
View full analysis
~/.openclaw/mcporter.json << 'EOF' { "mcpServers": { "hexin-ifind-stock": { "url": "https://api-mcp.51ifind.com:8643/ds-mcp-servers/hexin-ifind-ds-stock-mcp", "headers": { "Authorization": "Bearer " } }, "hexin-ifind-fund": { "url": "https://api-mcp.51ifind.com:8643/ds-mcp-servers/hexin-ifind-ds-fund-mcp", "headers": { "Authorization": "Bearer " } }, "hexin-ifind-edb": { "url": "https://api-mcp.51ifind.com:8643/ds-mcp-servers/hexin-ifind-ds-edb-mcp", "headers": { "Authorization": "Bearer " } }, "hexin-ifind-news": { "url": "https://api-mcp.51ifind.com:8643/ds-mcp-servers/hexin-ifind-ds-news-mcp", "headers": { "Authorization": "Bearer " } } } } EOF ``` ### Technical Analysis The setup instructions store a reusable bearer token in a plaintext JSON file but do not explicitly set restrictive permissions on either the directory or the file. `mkdir -p` and shell redirection derive their resulting modes from the user's current `umask`. On a system with a permissive or misconfigured `umask`, the configuration may be readable by other local users or processes operating under different accounts. Possession of a bearer token is generally sufficient for authentication, so disclosure can permit API use without knowledge of a separate password. The token is transmitted to documented HTTPS endpoints, and no hardcoded real credential was found in the project. The issue is limited to local storage permission hardening. ### Attack Path 1. A user follows the setup instructions on a shared system with a permissive `umask`. 2. The `.openclaw` directory or ` ...[truncated 1035 chars]
Remediation
View remediation
"$HOME/.openclaw/mcporter.json" <<'EOF' { "mcpServers": { "...": { "headers": { "Authorization": "Bearer " } } } } EOF chmod 600 "$HOME/.openclaw/mcporter.json" ``` 5. Prefer an operating-system credential store or secret manager if supported by `mcporter`. 6. Use narrowly scoped, short-lived tokens where the service supports them, and document immediate token rotation after suspected disclosure. 7. Avoid copying the configuration into logs, bug reports, backups, or source-control repositories. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash
# 安装 Node.js (如果没有)
# macOS: brew install node
# Linux: sudo apt install nodejs

# 安装 mcporter
npm install -g mcporter

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to place a Bearer token into a local JSON config and use it for authenticated requests, but it does not warn that this credential is sensitive, long-lived, and could be exposed through shell history, shared config files, backups, screenshots, or accidental commits. In a skill intended for broad user adoption, normalizing direct plaintext token handling without safeguards increases the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill recommends persisting an authentication token in ~/.openclaw/mcporter.json, creating a durable local secret store without discussing permissions, lifecycle, or cleanup. Persistent plaintext credentials are easier to steal via local compromise, backups, multi-user access, or accidental disclosure than ephemeral credentials.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

将密钥配置到 ~/.openclaw/mcporter.json（推荐，跨平台兼容）：

bash
mkdir -p ~/.openclaw
cat > ~/.openclaw/mcporter.json << 'EOF'
{
  "mcpServers": {

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file uses Chinese for headings, authentication guidance, examples, and error descriptions, but does not indicate that the skill is region-specific or provide an opt-in language choice. Under the language/locale policy, forcing a single language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.