京东黄金智能助手

• Outcome: Review
• Latest audit: Jul 28, 2026 · 12:12 PM UTC
• Version: 1.0.0

Overview

This gold assistant is broadly coherent, but it needs Review because it can store financial login tokens, replace its own files during upgrades, and run persistent automated simulated trading.

Install only if you are comfortable granting this skill access to your JD gold account data and local token storage. Review the automated simulated-trading托管 and upgrade behavior carefully, avoid treating its market-timing output as personalized financial advice, and prefer an environment with OS-backed secure credential storage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (39)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use shell commands, network access, file reads/writes, and environment-dependent behavior, yet it declares no permissions or capability boundaries. This creates a mismatch between what the skill can do and what reviewers or policy engines may expect, increasing the risk of unauthorized command execution, secret access, or filesystem changes without explicit governance.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The document exposes a built-in self-update workflow that can download and apply a package which overwrites the local skill files. For a gold-assistant skill, this capability is outside the core user-facing purpose and creates a supply-chain and arbitrary code modification risk if the update source, transport, or verification flow is compromised or misused.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: These instructions specifically document downloading a package and applying it by extracting over the existing installation, which enables local code replacement. Even with a SHA256 check mentioned elsewhere, this is still dangerous because the skill gains an operational path to mutate its own codebase beyond its stated gold-assistant functionality.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document goes beyond passive position diagnosis and gives prescriptive market-timing, position-sizing, and short-selling instructions. In a retail gold holding assistant context, this materially expands the skill from informational support into actionable investment guidance, increasing the chance that users execute risky trades based on unqualified or incomplete advice.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Instructions such as '反手做空' and '满仓做空' are especially dangerous because they imply leveraged/speculative behavior that does not fit a consumer gold accumulation or holding-diagnosis product. Users may be induced into products or behaviors outside the intended scope, potentially causing substantial financial loss and regulatory exposure.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: This skill includes host-level process discovery and termination logic (lsof, ps, os.kill) that goes beyond the expected scope of a finance assistant. In a shared workstation or agent environment, this can disrupt unrelated local processes or be misused to interfere with other services if the identification logic is wrong or manipulated.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script reads the CLAW environment variable and forwards it as a custom x-claw header on outbound requests to the manifest and package URLs. This creates an undocumented exfiltration channel for environment-derived data and expands the network-facing behavior beyond what is needed for a local gold-assistant upgrade flow.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file implements a remote manifest fetch and package download mechanism that is not part of the stated business purpose of a gold pricing/analysis assistant. Hidden update logic increases attack surface because compromise of the manifest source or configuration can cause the skill to retrieve attacker-controlled content.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The apply path extracts a downloaded archive directly into the skill directory, overwriting local files and then updating version metadata. Even with a basic path traversal check and SHA256 comparison, this is dangerous because a malicious or compromised manifest/package can replace executable skill files and persist altered behavior.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list includes very broad everyday phrases such as generic questions about recent events or capabilities, which can cause the skill to activate unintentionally. When a skill can perform networked actions, login flows, upgrades, or local persistence, accidental invocation increases the chance of unwanted sensitive operations or user confusion.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The skill documentation describes sending access tokens and sensitive account/holding data to backend APIs without any explicit user-facing notice, consent boundary, or data minimization guidance. In a finance-related skill handling holdings and trade data, this increases privacy and compliance risk because users may not realize their financial information is being transmitted and processed remotely.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The automatic login flow launches a browser, performs token exchange, and may poll in the background, but the instructions do not require a clear warning or affirmative consent before starting authentication side effects. Because this is a financial account login flow, unexpected browser launch and session establishment can surprise users and create trust, privacy, and phishing-surface concerns.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The upgrade flow can download and apply updates that overwrite local files, yet the documentation lacks strong warnings about code replacement, failure modes, rollback, and trust boundaries. This is dangerous because users or operators may trigger a destructive operation without understanding that the installed code will be modified.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explicitly supports requests like opening a gold dashboard/watchlist tool, but it provides no warning, consent step, or clarification that an external tool or UI may be launched. While this is not direct code execution, it can surprise the user, alter their environment, or trigger navigation/actions they did not clearly authorize, which is a legitimate safety issue in agent workflows.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are very broad (e.g. "有什么新闻/资讯", "X有什么消息") and can match common conversational requests that may not clearly indicate the user wants this specific skill invoked. In an agent routing context, this can cause over-triggering, unintended tool use, and disclosure or presentation of external/news content when the user’s intent was ambiguous or belonged to another capability.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown provides concrete entry, exit, stop-loss, and position-allocation instructions without prominent warnings that following them can cause financial loss and may not suit the user's circumstances. This omission is risky in a ToC investing context because users may reasonably interpret the content as endorsed, personalized guidance.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The file embeds a default API key directly in source code and uses it automatically when no environment variable is set. Hardcoded credentials can be extracted from the repository or package, then abused for unauthorized API access, quota theft, billing impact, or impersonation of this skill's traffic.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code is designed to attach an x-claw header that reports client-type metadata on all outbound requests, with no visible consent, minimization, or user-facing disclosure. While not a secret by itself, this creates unnecessary metadata leakage and can enable fingerprinting, traffic segmentation, or policy discrimination by upstream services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When the secure backend fails, the code silently falls back to plaintext file storage, causing secrets to be written unencrypted at rest without any user-visible warning or explicit consent. In a skill that handles access tokens and trading-related account state, this increases the chance of local credential theft from disk, backups, or multi-user environments.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The upgrade apply operation performs bulk extraction over the installation directory and deletes the downloaded archive afterward, but the execution path itself provides no user-facing confirmation or warning about destructive modification. In practice this makes accidental or coerced updates easier and reduces the chance a user notices unauthorized file replacement.

Credential Access

High

• Category: Privilege Escalation

Content

# --------------------------------------------------------------------------- #
# 文件回退后端（0o600 明文，兼容无 Keychain/DPAPI 的环境）
# --------------------------------------------------------------------------- #
def _file_path(name, cache_dir=_CACHE_DIR):
    return os.path.join(cache_dir, f"{name}.secret")

• Confidence: 96% confidence
• Finding: The fallback backend stores secrets in plaintext files protected only by filesystem permissions. In the context of a consumer gold-trading assistant that may store access tokens, local disk compromise, weak home-directory permissions, backups, or shared-user scenarios can lead to credential disclosure and account misuse.

Credential Access

High

• Category: Privilege Escalation

Content

p = _platform()
    try:
        if p == "macos":
            return _keychain_save(name, value)
        if p == "windows":
            return _dpapi_save(name, value)
    except Exception:

• Confidence: 94% confidence
• Finding: This logic silently downgrades from Keychain/DPAPI to plaintext file storage on any exception, expanding credential exposure without notifying the user. Because the skill handles financial-access tokens, the context makes this more dangerous: leaked local credentials could enable account access, transaction visibility, or unauthorized actions depending on token scope.

Credential Access

High

• Category: Privilege Escalation

Content

p = _platform()
    try:
        if p == "macos":
            val = _keychain_load(name)
            if val is not None:
                return val
        elif p == "windows":

• Confidence: 92% confidence
• Finding: The load path falls through to the plaintext file backend whenever secure retrieval fails or returns nothing, preserving compatibility but also normalizing insecure secret persistence. This makes plaintext tokens a first-class source of truth, which increases the blast radius of local file disclosure in a financial-assistant context.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `sim_autotrade.py` 的 `--claw` 是**必传启动参数**：部署时按用户**实际客户端**填写（如 `codex` / `openclaw` / `joycode`），不得写死或假设。
- 脚本每次调用底层（`jos.py` / `query_sim_contest.py`）都**透传** `--claw`，底层随请求附加 `x-claw` 请求头**上报服务端**，用于统计调用方客户端类型。
- launchd 模板 `scripts/autotrade.launchd.plist.txt` 中以占位符 `__CLAW__` 表示，**无需手动改名或替换**——由 `sim_autotrade.py --install-launchd` 自动读取模板、替换占位符并加载。

#### 部署指引（三步授权通过后执行）

• Confidence: 93% confidence
• Finding: Reference to a plist-backed launchd template indicates the skill is designed to materialize persistent OS-level configuration files. Writing and loading such files is a persistence primitive that should be treated as high risk, especially when combined with shell and file-write capabilities in a consumer finance assistant.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **确认登录态与剩余时长**：`python3 scripts/jos.py token --claw <客户端> --json`，读 `remaining_human` 用大白话告知用户「还能托管约 X」。
2. **先 dry-run 验证**：`python3 scripts/sim_autotrade.py --claw <客户端> --dry-run`，确认登录/行情/策略/降级均正常再正式启动。
3. **部署 launchd 定时任务**：执行 `python3 scripts/sim_autotrade.py --claw <客户端> --install-launchd`（可选加 `--daily-cap <数值>` 设单日上限）。脚本会**自动**读取模板、替换占位符 `__CLAW__` / `__PROJECT_DIR__` / `__PYTHON__`、生成 plist 到 `~/Library/LaunchAgents/` 并 `launchctl load` 启动，**无需手动改名或复制**。停止托管执行 `python3 scripts/sim_autotrade.py --claw <客户端> --uninstall-launchd`。

### 查询能力

• Confidence: 96% confidence
• Finding: Using launchctl to load a job is a direct persistence action, not merely documentation or passive storage. In a skill that can install, upgrade, authenticate, and trade, this materially increases the risk of long-lived automated behavior and makes accidental or malicious misuse much harder for users to notice and stop promptly.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/jdjr_config.py:34