Security audit

stock-monitor

Security checks for vulnerabilities and agentic risk

Overview

This stock-monitoring skill is mostly coherent, but it can include private portfolio details in reports that are pushed to a Feishu group without clear consent boundaries.

Install only if you are comfortable with local holdings, cost basis, trades, and profit/loss being used in reports and potentially posted to Feishu. Review the report prompts and cron configuration first, confirm the Feishu destination, remove private fields or use a watchlist-only mode if possible, and back up local JSON files before using mutating trade or position commands.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The template instructs the agent to send generated reports to a Feishu group chat, which is an external communication action not described in the skill metadata. Because the report incorporates local portfolio and position data, this creates a real risk of unauthorized data transmission outside the local environment without explicit user consent or manifest disclosure.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The code claims trades will intelligently sync positions, but the CLI buy/sell paths bypass that logic and directly mutate holdings, creating inconsistent portfolio state. This can silently corrupt financial records, causing users or downstream agents to act on inaccurate positions, P&L, and risk calculations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill processes personal holdings and trade-history files, then describes generating reports and pushing them to a Feishu group, but it does not clearly warn that sensitive portfolio information may be transmitted externally. This can expose account positions, trading behavior, and inferred financial status to unintended recipients or group members.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document exposes state-changing commands for watchlists and positions (add, remove, position add/remove) without clearly warning that they persistently modify portfolio-related data. In an agent skill context, terse command references can be executed or suggested automatically, so the lack of write/destructive-operation labeling increases the risk of accidental data loss or unintended portfolio changes.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The trade buy/sell commands are documented as simple record operations but do not warn that they write durable transaction-history entries. In a financial tracking skill, undocumented persistence can mislead an agent or user into treating these as harmless analysis commands, causing inaccurate records, audit confusion, or unwanted state changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly stores portfolio, position, and trade-history data under a predictable local path in the user's home directory but does not warn that this data is sensitive financial information. While this is not code execution, it increases the chance users leave highly sensitive records unprotected, exposing holdings and transaction history to other local users, backups, sync tools, or malware.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The backup/restore section tells users to copy raw JSON files containing positions and trading history without any warning that the backups themselves are sensitive artifacts. This can lead to accidental exposure through insecure backup locations, shared directories, emailed files, or retained stale copies that preserve historical financial data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documented workflow explicitly includes external web fetching for stock-related news and automatic report delivery to a Feishu group, but it does not mention privacy, data handling, or consent boundaries. Because the skill also reads local portfolio, positions, trades, and alert files from ~/.openclaw, users may unknowingly cause sensitive financial data or inferred holdings to be transmitted externally or posted to a group channel.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The prompt directs reading local stock pool and position files that may contain sensitive portfolio holdings and cost-basis information, yet provides no warning, minimization, or consent boundary around that access. In context, accessing those files is functionally related to the skill, but it still exposes private financial data and increases downstream leakage risk, especially because the same template later transmits reports externally.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The prompt explicitly instructs sending the generated report to a Feishu group chat without warning that it may include holdings, cost basis, P&L, and other sensitive portfolio information sourced from local files. This is a direct external exfiltration path for private financial data, and the surrounding skill context makes it more dangerous because the report format requires detailed position-level content rather than generic market commentary.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Position data is written to persistent files under the user's home directory without explicit notice or confirmation, which can expose sensitive financial holdings to other local users, backups, or tooling that scans dotfiles. In an agent-skill context, silent persistence is risky because users may expect ephemeral analysis rather than durable storage of portfolio data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Trade history is persisted locally without explicit disclosure, creating a durable record of sensitive financial activity that may be accessible via backups, shared accounts, or local compromise. Because transaction history is more sensitive than watchlist data, undisclosed storage materially increases privacy risk in this skill's context.

Static analysis

No suspicious patterns detected.