Security audit

111

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to generate A-share market reports as advertised, but it asks users to store several credentials in plaintext and has unclear automatic persistence behavior.

Review this skill before installing. Do not put broker, data-provider, email, or webhook credentials into the YAML file unless you understand where that file will be stored and backed up; prefer environment variables or a local secret manager. Check for any cron job before running it, and be aware that generated financial reports are saved under ~/.openclaw/workspace/reports by default.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: config.yaml:16
Finding: Plaintext Credential Storage in Configuration Template<![CDATA[ ## Vulnerability Details **File Location**: `config.yaml`, lines 16-63 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```yaml TUSHARE_TOKEN: "Tushare token placeholder" JOINQUANT_USERNAME: "" JOINQUANT_PASSWORD: "" IFIND_USERNAME: "" IFIND_PASSWORD: "" SMTP_SERVER: "smtp.qq.com" SMTP_PORT: "587" EMAIL_USERNAME: "Email address placeholder" EMAIL_PASSWORD: "Email authorization-code placeholder" RECIPIENT_EMAIL: "Recipient email address placeholder" SERVERCHAN_SCKEY: "" WECHAT_WEBHOOK: "" ``` The placeholder descriptions above are English translations of the non-secret placeholder values in the audited configuration. The credential keys and storage structure are unchanged. ### Technical Analysis The distributed YAML configuration instructs users to place reusable API tokens, account passwords, email authorization codes, messaging keys, and webhook URLs directly into a plaintext file. The file comments claim that a copied `config_local.yaml` file will be excluded from version control, but the audited project contains no `.gitignore` file that enforces this protection. The executable code currently reads `TUSHARE_TOKEN` from this configuration and provides it to the Tushare SDK. The JoinQuant, iFinD, email, ServerChan, and WeChat credentials are not consumed by the reviewed implementation, so exposing fields for these credentials unnecessarily increases the sensitive-data footprint. Plaintext configuration files are commonly copied into source repositories, backups, support bundles, shared archives, and build artifacts. Unlike short-lived credentials obtained at runtime, secrets stored this way remain reusable by anyone who obtains the file. ### Attack Path 1. A user copies `config.yaml` to `config_local.yaml` as directed by the configuration comments. 2. The user enters a valid Tushare token, account password, email authorization code, messaging key, or webhook URL. 3. The user assumes the ...[truncated 1447 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove password, authorization-code, key, and webhook fields that are not used by the implementation. 2. Obtain required secrets from environment variables or an operating-system secret manager rather than ordinary YAML files. 3. Keep only non-sensitive settings in `config.yaml`; provide a separate example file containing clearly invalid placeholders. 4. Add and verify version-control exclusions for local secret files, including: ```gitignore config_local.yaml config.*.local.yaml .env .env.* ``` 5. Validate configuration values and reject known placeholder strings instead of treating them as valid tokens. 6. Restrict secret-file permissions to the owning user where file-based secrets remain unavoidable. 7. Avoid printing secrets in logs, errors, generated reports, or diagnostic output. 8. Document credential rotation and immediate revocation procedures for accidentally committed secrets. 9. Add automated secret scanning to development and release workflows. 10. If a populated configuration has previously been committed, remove it from repository history and rotate every affected credential; deleting only the latest copy is insufficient. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase "分析市场" is broad and likely to appear in ordinary conversation about finance, which can cause accidental invocation of the skill. Because the skill is designed to generate trading analysis and may kick off downstream automated behavior, unintended activation could confuse users or trigger unwanted actions at the wrong time.

Vague Triggers

Medium

Confidence: 98% confidence
Finding: Using the single word "Marcus" as a trigger is highly ambiguous because it can refer to a person's name in normal dialogue. This increases the chance of unintended skill activation whenever a user mentions Marcus casually, which is especially risky in an agent setting where activation may lead to automated analysis or task execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states that a Tushare token is embedded, which implies a credential is stored inside the skill or its runtime environment. Even if the literal token is not shown in this file, documenting embedded credentials without warning or secure-handling guidance normalizes insecure secret management and increases the risk of credential leakage, unauthorized API use, or downstream compromise if logs, code, or configs are exposed.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This manifest-style config embeds all user-facing instructions and labels in Chinese, including setup steps and operational guidance. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified or alternatives are offered.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The file's natural-language interface, title, and execution description are entirely in Chinese and targeted specifically at A-share users, with no indication that other languages are supported or that the user can choose a locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The script exposes an optional `-o/--output` path but unconditionally also writes a second copy of the generated report to `~/.openclaw/workspace/reports` via `save_report()`. This can violate user expectations, leak potentially sensitive financial analysis or configuration-derived content into a fixed location, and create unauthorized persistence on shared or managed systems.

Natural-Language Policy Violations

Low

Confidence: 83% confidence
Finding: The package description is written entirely in Chinese and specifically frames the skill as an 'A股' analysis agent, which suggests a language/locale assumption without any indication that users can choose another language. Under the policy, language or locale constraints should be opt-in or clearly justified.

Static analysis

No suspicious patterns detected.