T09 · Insecure Skill Coding Practices
Error
- Location
payment_utils.py:226- Finding
Payment Credential Verification Fails Open
- Content
View full analysis
- Remediation
View remediation
Security audit
Libu Premarket
Security checks for vulnerabilities and agentic risk
Overview
The skill largely matches its paid A-share premarket report purpose, but it under-discloses automatic loading of code from another local skill directory and has weak payment and dependency controls.
Install only after reviewing the publisher and running it in an environment where the broad file, network, and environment-variable access is acceptable. Avoid having an untrusted ~/.openclaw/skills/tushare-finance/scripts/api_client.py present, consider pinning dependencies before use, and treat the payment/licensing checks as weak rather than a strong security boundary. I did not find destructive actions or secret exfiltration in the reviewed files.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T07 · Tool Hijacking and Spoofing
Warning
- Location
pre_market.py:130- Finding
Automatic Execution of Code from an External Sibling Skill Directory
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Mutable and Unpinned Third-Party Dependencies
- Content
View full analysis
=1.5.0 requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89 gmssl>=3.2.0 ``` ```bash npx clawhub@latest install libu-premarket ``` ```bash pip3 install gmssl ``` ### Technical Analysis The Python requirements use open-ended minimum-version constraints and provide no lock file or package hashes. Installation may therefore resolve to future package releases that were never reviewed with this Skill. The documented `npx clawhub@latest` command similarly downloads and executes a mutable latest version of the package installer. These choices make installations non-reproducible and expose users to future package compromise, malicious release publication, account takeover, or incompatible dependency changes. The audit did not establish that any currently named dependency is malicious. The confirmed issue is the unsafe dependency-resolution and installation practice. ### Attack Path 1. A package publisher account, package registry, or upstream release process is compromised. 2. A malicious or backdoored future version is published under one of the allowed dependency names or as the latest `clawhub` release. 3. A user follows the documented installation command or installs from `requirements.txt`. 4. The package manager resolves and downloads the compromised version because no exact version or integrity hash is required. 5. Malicious installation-time or import-time code executes with the installing or running user's privileges. ### Impact Assessment A compromised dependency can execute arbitrary code with the privileges of the user installing or running the Skill. Potential scope includes environment-variable access, local file access, modification of g ...[truncated 223 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose omits several materially relevant behaviors: payment verification utilities, local archive extraction, broad external network access, and persistent reads/writes to local directories. That mismatch reduces informed consent and can cause agents or users to run a skill with broader trust assumptions than warranted, especially because it touches local files, secrets, and external services.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose omits several materially relevant behaviors: payment verification utilities, local archive extraction, broad external network access, and persistent reads/writes to local directories. That mismatch reduces informed consent and can cause agents or users to run a skill with broader trust assumptions than warranted, especially because it touches local files, secrets, and external services.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a full local payment and credential-verification workflow even though the skill is ներկայացված as a stock premarket analysis tool. This capability mismatch is dangerous because it introduces hidden monetization and credential-handling behavior outside the user’s expected trust boundary, increasing the risk of unauthorized billing flows, sensitive token exposure, and deceptive functionality.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python �部侍郎-A股盘前作战地图" # SM4 密钥 (Base64, 16字节) - 由京东邮件提供 # 🚨 安全修复: 移除硬编码默认值，延迟到实际使用时检查 _SM4_KEY_BASE64 = os.environ.get("CLAWTIP_SM4_KEY") # ClawTip 收款服务ID (payTo) - base64编码，防肉眼直接提取 # 注意: 实际值通过 base64 解码 _PAY_TO_B64 获得，不在注释中明文存储 _PAY_TO_B64 = "ODVhZTg5NWMxYTA4YTdlMmVmZTVmMThiNzM5ZTMzMzcyMDI2MDQxODE0MjIyODAwMjAwMDY5ODhERnRtclNBdkdoRWFacDNsemtrcGJuS29mWFRnQnNmc1I2aWF6ek9iQnY0anF5akNzcjk4ZlZDZjRsUldEUmp0eXFaTVFpQVk=" _PAY_TO = base64.b64decode(_PAY_TO_B64).decode("utf-8") def _require_sm4_key(): """延迟校验 SM4 密钥，避免 import 时直接崩溃""" key = os.environ.get("CLAWTIP_SM4_KEY") or _SM4_KEY_BASE64 if not key: print("[支付] 🚨 CLAWTIP_SM4_KEY 未设置") print("[支付] 💡 export CLAWTIP_SM4_KEY='你的SM4密钥'") sys.exit(1) return key # 标准订单路径: ~/.openclaw/
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code claims release builds strictly verify payment credentials, but actually bypasses verification whenever the file path contains the substring "libu-research". This is a weak, spoofable trust check: an attacker can place or rename the skill into a matching path to disable payment verification, undermining the integrity of the enforcement logic and indicating deliberate hidden bypass behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation declares no explicit tool scope or permissions even though its described operation clearly requires environment-variable access, local file read/write, archive extraction, and network access. This weakens user and platform visibility into what the skill can do, increasing the chance that it is granted broader access than expected and making review harder.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language content throughout the skill README is exclusively Chinese, including setup, payment, warnings, and support instructions. The policy requires flagging skills that force a specific language without user opt-in unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
Using
npx clawhub@latest install libu-premarketpulls and executes the latest package version at install time, which is a supply-chain risk. If the upstream package is compromised or a breaking release is published, users may execute unreviewed code during installation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing description is entirely in Chinese and does not indicate any language choice or opt-in. Under the policy criteria, forcing a specific language or locale without offering an alternative is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This Python file contains core module documentation entirely in Chinese, and later user-facing status/help messages are also emitted only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes local order creation, credential ingestion, and payment verification capabilities that are not justified by the stated stock-analysis purpose. Even if the crypto checks are intended as protection, the mere presence of billing integration expands the attack surface by writing payment artifacts to local disk and trusting local file-based state that other local processes may tamper with.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing natural-language strings and documentation in Chinese only, starting from the module docstring and continuing throughout the script. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script embeds payment enforcement logic that is unrelated to its stated stock-selection function and gates execution based on local environment conditions. While not directly a classic vulnerability like RCE, it introduces hidden control-flow and trust decisions inside the skill, increasing supply-chain and user-trust risk because behavior depends on bundled monetization code rather than the advertised task.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file contains user-facing natural language entirely in Chinese, including release headings and descriptions, with no indication that the skill is region-specific or that users can opt into a language. Under the policy rule for language/locale constraints, forcing a specific language without documented choice or justification is a natural-language policy concern.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python # 标准库调用方式：api.fina_indicator(...) # 自定义库调用方式：api.pro.fina_indicator(...) if API_TYPE == "standard": func = getattr(API_OBJ, method_name) else: func = getattr(API_OBJ.pro, method_name) return func(**kwargs)
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python if API_TYPE == "standard": func = getattr(API_OBJ, method_name) else: func = getattr(API_OBJ.pro, method_name) return func(**kwargs) except Exception as e: print(f"[Tushare Error] {method_name}: {e}")
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows installation of any newer release and makes builds non-reproducible. This increases supply-chain risk because a future vulnerable or malicious upstream version could be resolved without review, and it also prevents auditors from knowing exactly which version is deployed.
- Content
text pandas>=1.5.0 requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Because pandas is unpinned, it is impossible to verify from this manifest whether the installed version is affected by known advisories. The direct risk depends on the actual resolved version, but the manifest itself creates an auditability gap that can hide vulnerable deployments.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Using requests>=2.28.0 permits unreviewed future versions to be installed, which weakens reproducibility and dependency assurance. Because requests has a history of security advisories, leaving it unpinned makes it harder to determine exposure and raises the chance of pulling an unsafe release.
- Content
text pandas>=1.5.0 requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89 gmssl>=3.2.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
requests has multiple known advisories, and the absence of exact version pinning means the deployed version cannot be assessed from the manifest alone. Since this package is commonly used for outbound HTTP and can affect credential handling, redirects, and TLS-related behavior, unverifiable versioning materially increases operational security risk.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
A minimum-only version for numpy allows dependency drift across environments and time. That can introduce vulnerable or incompatible upstream releases unexpectedly and makes incident response and SBOM verification more difficult.
- Content
text pandas>=1.5.0 requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89 gmssl>=3.2.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The manifest does not identify an exact numpy release, so any known advisories affecting some versions cannot be ruled out. Even if exploitation depends on application usage, this uncertainty is itself a supply-chain weakness because operators cannot confidently prove they are on a safe version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The tushare dependency is not pinned to an exact version, so future installs may resolve to different code than what was tested. For a data-driven financial skill, this creates supply-chain and reliability risk because unexpected upstream changes could affect behavior or security.
- Content
text pandas>=1.5.0 requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89 gmssl>=3.2.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
gmssl is also unpinned, which is more sensitive than a generic utility package because cryptographic libraries affect confidentiality and integrity decisions. Allowing arbitrary newer versions without review increases the risk of silently introducing a flawed or malicious crypto implementation.
- Content
text requests>=2.28.0 numpy>=1.23.0 tushare>=1.2.89 gmssl>=3.2.0
Static analysis
No suspicious patterns detected.