ClawHub
Back to skill

Security audit

盘前雷达

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public market and news data, creates local reports, and optionally posts a disclosed Feishu update; its risks are mostly configuration and data-integrity cautions rather than hidden or malicious behavior.

Install only if you are comfortable with the skill fetching public finance/news data and writing reports under its output directory. Treat the output as research, not investment advice. If enabling Feishu push, use trusted webhook secrets and do not set NOTIFY_HUB_SCRIPT to an untrusted file; prefer HTTPS-only data fetching if you modify the skill.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'NOTIFY' from os.environ.get (line 33, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
print("请先安装 notify-hub skill，或设置 NOTIFY_HUB_SCRIPT 环境变量。")
            sys.exit(1)
        print(f"推送到: {target}")
        r = subprocess.run(
            [sys.executable, NOTIFY, "send", "card", json_path, "--to", target],
            capture_output=True, text=True,
        )
Confidence
97% confidence
Finding
The script executes a Python file whose path is taken from the `NOTIFY_HUB_SCRIPT` environment variable with no trust validation beyond existence. An attacker who can influence the environment can point this variable to an arbitrary local script, causing arbitrary code execution when `--send` is used.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises operational scripts that read/write local files, make network requests, invoke shell commands, and use environment variables, but the manifest does not declare any corresponding permissions or capabilities. This weakens user transparency and platform enforcement, making it easier for a user or host system to execute broader actions than expected, especially because the skill also includes push and webhook flows.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill description says 'zero third-party dependency' and 'no key out of the box,' but the documented behavior includes optional FRED API key usage, dependency on an external notify-hub path for local Feishu push, and webhook secrets for cloud push. This mismatch can mislead users into enabling or trusting automation they do not fully understand, including secret-backed outbound messaging and undeclared integrations.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger list contains broad natural-language phrases such as '外围市场', '全球风险', and '今日外围', which may overlap with ordinary conversation and cause accidental activation. In a skill that performs network collection, report generation, and optional message pushing, unintended activation can lead to unnecessary data fetching or unreviewed outbound actions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script explicitly prefers plain HTTP for GDELT requests before falling back to HTTPS, which exposes outbound query contents and the returned JSON to interception or tampering by any network attacker on the path. Even if the queries are not highly sensitive, a man-in-the-middle could alter news results and thereby manipulate the downstream risk signal or trading-oriented output produced by the skill.

Static analysis

No suspicious patterns detected.