T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_monitor.py:322- Finding
Market Data Retrieved over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
stock-monitor
Security checks for vulnerabilities and agentic risk
Overview
This stock monitoring skill is mostly coherent, but it can store sensitive portfolio and trade data and send reports to Feishu without a clear approval or redaction step.
Review this skill before installing. Use it only if you are comfortable storing portfolio and trade records under ~/.openclaw and potentially including those details in scheduled Feishu reports. Disable or edit Feishu delivery unless you have verified the destination, and avoid the documented pip install workaround unless the publisher fixes it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stock_capital.py:30- Finding
Capital-Flow and Trading-List Data Retrieved over Unencrypted HTTP
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/troubleshooting.md:186- Finding
Unsafe Installation Guidance for Python Standard-Library Modules
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description promises a broader stock monitoring and analysis capability: custom watchlist monitoring, real-time market data, technical indicator analysis, rise/fall trend prediction, and signal reminders. The actual code only retrieves quote data from Tencent endpoints for a fixed list of Hong Kong indices/stocks and computes one MA20 value for the Hang Seng Index. It then prints quote information. There is no mechanism for user-defined stock pools, no prediction model or trend-forecasting logic, and no reminder/signal system. While the code is related to stock quote monitoring and includes a small amount of technical analysis, it materially underdelivers relative to the declared purpose, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad stock monitoring/analysis skill centered on watchlist monitoring, real-time行情, technical analysis, trend prediction, and alerts. The supplied code chunk is much narrower and materially different: it fetches and formats 东方财富-based capital-flow data for stocks and sectors, 龙虎榜 listings, and northbound fund flow/top stocks, with a command-line interface. Although this is stock-related and could be considered adjacent analysis, the core advertised capabilities are mostly absent from the code. The only slight overlap is stock data reporting in general; however, the primary implemented purpose is capital-flow and leaderboard reporting, not monitoring, prediction, or alerting. Therefore this is a clear description-behavior mismatch.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt requires sending the generated report to a Feishu group chat but does not warn that portfolio analysis, holdings, and market-derived recommendations may be transmitted externally. This is dangerous because it combines local sensitive data access with mandatory third-party disclosure, creating a clear confidentiality and privacy risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares broad capabilities in metadata, including access to local portfolio files, write-capable configuration files, Python execution, and network access, but it does not define an explicit tool-scope boundary such as permissions or allowed-tools. That omission increases the chance that an agent can read sensitive trading data or modify local cron/job configuration beyond what the user expects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly includes pushing generated reports to a Feishu group chat, while the reports are derived from local files containing stock positions and trade history. Without a clear warning, consent step, and disclosure of what leaves the machine, the skill risks unintentional exfiltration of sensitive financial and behavioral data to third parties or broad audiences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The command reference includes state-changing portfolio and trade commands such as position add/remove and trade buy/sell, but does not clearly warn that they persistently modify stored holdings and transaction history. In an agent-executed skill, this can cause unintended financial record changes if a user or downstream system assumes these are read-only analysis commands.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document provides restore commands that copy backup files directly over live configuration files without any warning that existing local data will be replaced. In this skill, those files contain stock watchlists, positions, trades, and alerts, so an unaware user could accidentally destroy or roll back sensitive financial records and monitoring settings.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly describes pushing generated reports to a Feishu group, but it does not warn users that report contents may include portfolio composition, holdings status, trading context, and derived market analysis. Because this happens on a schedule and through an external messaging channel, users may unintentionally exfiltrate sensitive financial information to broader audiences or misconfigured group destinations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states that scheduled tasks read local stock pool, positions, trades, and alert configuration files, but it does not clearly disclose that these files may contain sensitive personal investment data that will be processed automatically. In the context of scheduled reporting and external message delivery, this omission increases the risk of privacy loss or unintended disclosure of a user's financial activity.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This markdown file contains user-facing operational guidance exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The prompt explicitly instructs the agent to use external search, web scraping, and shell-based retrieval paths such as tavily_search, Exa, Jina via curl, and direct web_fetch outside the core stock-monitor tooling. This expands the skill's effective capabilities to arbitrary network retrieval and shell execution, increasing the risk of prompt injection from fetched pages, unintended data exfiltration, and use of tools not declared as part of the skill's narrow stock-monitor purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instructions tell the agent to read local stock-pool and stock-positions files containing portfolio and holding data without any warning, consent step, or disclosure to the user. Accessing local financial files silently increases privacy risk and can expose sensitive investment positions to subsequent processing or transmission.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt directs the agent to send generated reports to a Feishu group chat, which introduces outbound messaging/distribution beyond pure analysis. Because the reports include holdings, positions, signals, and potentially sensitive financial context, this creates a direct exfiltration path to an external destination that is not clearly bounded by the skill metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The Hong Kong stock reporting flow repeats the same pattern of reading local stock pool and position files without warning or consent. Even though this is within a finance-oriented skill, silent access to local holdings remains sensitive because it reveals the user's investment interests and positions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template embeds concrete trading actions such as dynamic take-profit and liquidation thresholds while only appending a brief disclaimer at the end. This can cause users to treat the generated report as actionable financial advice, increasing the risk of monetary loss if the guidance is followed without suitability, risk tolerance, or regulatory context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section goes beyond market commentary and provides detailed buy ranges, sell ranges, stop-loss, and target prices, which are highly actionable instructions affecting real assets. In the context of a stock-monitoring skill, users are especially likely to rely on these outputs for execution, making financial harm more likely than in a generic templating file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The checklist requires reports to follow a specifically Chinese market presentation convention, and the entire template is written as a mandatory format rather than an optional locale setting. This can violate language/locale policy when used in broader contexts because it forces a locale-specific output style without user opt-in or a documented region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill hard-codes Chinese stock names and later emits Chinese-language analysis strings throughout the output, which imposes a specific locale on all users. The file does not provide any opt-in, configuration, or documented justification for restricting output language to Chinese.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings and user-facing output entirely in Chinese, including the module description and CLI help text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists portfolio holdings and trade history under ~/.openclaw, which expands it from passive market monitoring into maintaining sensitive financial behavior data on disk. In an agent-skill context, undeclared persistent storage of a user's holdings and trading activity can create privacy risk, data retention risk, and unexpected stateful behavior beyond the advertised purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code writes persistent position data without an explicit disclosure or confirmation at the write point. In an agent setting, silent persistence of financial holdings can violate user expectations and create privacy and integrity concerns because local state is modified even when the skill appears to be doing routine analysis.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
These functions implement trade recording and position synchronization, not just analysis, allowing the skill to create and maintain a durable model of a user's investments. That makes the skill more dangerous because the declared context is stock monitoring, so users may not expect sensitive transaction-like data to be stored or mutated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Trade history is appended to disk without clear user disclosure, creating a durable log of sensitive financial behavior. This is dangerous because trading history can reveal strategy, assets, and timing, and the writes happen silently as part of helper functions rather than through an obviously consented export flow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI exposes add/remove position and buy/sell trade commands, materially broadening the skill from monitoring into portfolio tracking and local record-keeping. In a security review, this is risky because an agent invoking the skill could alter or create persistent financial records without the user realizing that the operation is stateful and durable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The description and the rest of the file are entirely Chinese and include China-market-specific presentation conventions, but the skill does not explicitly state that it is limited to a Chinese-market/user context or offer any language choice. Under the policy, forced language or locale behavior without opt-in or justification can be a natural-language policy issue.
- Content