ClawHub
Back to skill

Security audit

market-data

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does market-data retrieval as described, but it ships an exposed Polygon API key and does not fully disclose the providers it contacts.

Review before installing. The skill appears intended for market and news lookups, but it should not ship a reusable Polygon API key; the publisher should rotate that key and load credentials from a protected user-controlled setting. Users should also expect outbound requests to Polygon, CoinGecko, Google News, and FairEconomy/ForexFactory when invoking the tools.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
src/index.js:2
Finding

Hard-Coded Polygon API Credential

Content
View full analysis

Vulnerability Details

File Location: src/index.js:2, with credential use at src/index.js:27
Vulnerability Type: Hard-coded secret and credential exposure through a URL query parameter
Risk Level: Medium

Complete Code Snippet:

js
import https from 'https';
const POLYGON_API_KEY = 'QR_WJk5DtOe_UU7ARlvcAASbX4rkuJCS';

// ...

const url = `https://api.polygon.io/v2/aggs/ticker/${ticker}/range/1/day/${from}/${to}?adjusted=true&sort=asc&limit=500&apiKey=${POLYGON_API_KEY}`;

https.get(url, (res) => {

Technical Analysis

A reusable Polygon API credential is embedded directly in distributable source code. Any person or process with access to the Skill package can recover the credential without invoking the Skill. The key is also placed in the request URL's query string. Although the request uses HTTPS, URLs may be recorded by application diagnostics, HTTP instrumentation, proxy logs, or monitoring systems.

The external request is necessary for the declared stock-market data functionality, and no unrelated sensitive information is transmitted. The vulnerability is therefore not the existence of the network request, but the insecure management and transmission of its credential.

Attack Path

  1. Obtain or inspect a copy of the Skill package.
  2. Open src/index.js and extract the value assigned to POLYGON_API_KEY.
  3. Submit independent requests to Polygon using the exposed key.
  4. Consume the credential owner's quota or use any data-access capabilities associated with the key until it is revoked, restricted, or exhausted.
  5. Alternatively, recover the query-string credential from any infrastructure that records complete outbound request URLs.

Impact Assessment

An attacker can authenticate to Polygon within the permissions and service limits assigned to the exposed key. Potential effects include unauthorized API usage, quota exhaustion, degraded availability for legitimate Skill re ...[truncated 317 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed Polygon API key immediately.
  2. Remove the credential from source code and version history.
  3. Load the replacement credential from a protected environment variable or secret manager, for example:
    js
    const POLYGON_API_KEY = process.env.POLYGON_API_KEY;
if (!POLYGON_API_KEY) {
  throw new Error('POLYGON_API_KEY is not configured');
}
  4. Avoid placing credentials in URLs. Use an authorization header if Polygon supports one for the applicable API.
  5. Apply provider-side restrictions, including minimum required API permissions, rate limits, spending limits, and monitoring alerts.
  6. Ensure logs, traces, proxy telemetry, and error reports redact credentials and query parameters.
  7. Add automated secret scanning to source-control and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

No manifest is available, so the skill's stated purpose is unknown. This file implements outbound HTTPS access to Polygon.io and embeds a market-data API key to fetch stock data, which is a substantive external capability not justified by any declared purpose or scope in the provided context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

A live API key is hardcoded in source and embedded directly into outbound requests. This exposes the credential to anyone with code access, enables unauthorized reuse or quota theft, and may cause financial or service-abuse impact if the key is harvested from the repository or distributed skill package.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/index.js (reported line 27)May include surrounding context.

js
fromDate.setDate(fromDate.getDate() - 100); // Go back 100 days from 'to' date
    const from = period1 || fromDate.toISOString().split('T')[0];
    
    const url = `https://api.polygon.io/v2/aggs/ticker/${ticker}/range/1/day/${from}/${to}?adjusted=true&sort=asc&limit=500&apiKey=${POLYGON_API_KEY}`;

    https.get(url, (res) => {
      let data = '';

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The inline comment says the function will show only the most recent 30 days for brevity, but the actual assignment uses the entire parsedData.results array because the slice operation is commented out. This is an active contradiction between documentation intent and runtime behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request URL hard-codes hl=en-US, gl=US, and ceid=US:en, which constrains results to a specific language and region. Under the policy, forcing a locale without user opt-in or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code uses toLocaleString('en-US', ...), which forces U.S. English formatting regardless of user preference. This is a locale policy violation unless the skill offers a choice or clearly documents why U.S. formatting is required.

Content

No source excerpt is available for this finding.