T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/data_sources.py:123- Finding
Market data retrieved over unauthenticated plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Portfolio
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent stock portfolio helper, but users should be careful with local financial data, optional scheduled messages, and unauthenticated market-data APIs.
Install only if you are comfortable storing portfolio positions and alert thresholds in local JSON files and sending stock symbols to third-party finance APIs. Do not use the free HTTP quote data or daily picks as the sole basis for trading decisions, and enable the cron/message examples only after reviewing exactly what they will send and where.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/portfolio_manager.py:17- Finding
Portfolio and alert records are created without explicit restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述声称这是一个完整的股票组合管理与预警技能，包含组合/持仓管理、收益计算、预警、推荐，并说明使用腾讯财经免费 API 且数据本地存储。但实际代码只是一个行情数据抓取模块，核心功能是把股票代码转换为不同供应商格式，并通过 urllib 从腾讯、新浪、东方财富获取报价，再由管理器做轮询容错。代码没有任何本地持仓、收益、预警、推荐或持久化存储实现。最明显的未声明能力是额外访问新浪财经和东方财富接口，这与“使用免费 API（腾讯财经）”不一致。因此描述与代码行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code substantially matches the core portfolio-management description: it manages holdings, persists data locally, calculates profit/loss summaries, and sets/checks alerts. However, the declared description includes additional capabilities not present in this code chunk, most notably '每日推荐' (daily recommendations). It also claims support for A-shares/HK/US quotes via Tencent Finance, but this file only imports
fetch_stock_pricefrom another module and does not itself demonstrate those specific data-source or market-coverage claims. Because the declared purpose overstates implemented capabilities in a material way, this should be flagged as a mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个较完整的股票组合管理与预警技能，但提供的代码块实际只是一个股票行情查询 CLI 脚本。其主要行为是根据股票代码获取单只股票行情并输出结果，这只覆盖了声明中的“行情查询”一小部分。更重要的是，代码顶部注释明确写有“多数据源轮询负载均衡”，并通过 data_sources.fetch_stock_price/get_manager 等接口取数，这与声明中“使用免费 API（腾讯财经）”不一致。代码中也没有看到任何与持仓、组合、收益、预警、推荐、本地数据存储相关的实现。因此该代码块与声明用途存在明显行为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises file read/write and network-driven behavior in its documentation, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an unnecessary trust gap: an agent or reviewer cannot easily determine what capabilities are intended, and undeclared file/network access increases the chance of over-broad execution in a host environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill stores holdings, alerts, and possibly query history on local disk, but the description does not clearly warn users up front about this persistence. Portfolio data is financially sensitive, and silent local retention can expose private investment positions or behavioral history to other local users, backups, or unrelated tools.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation directs users to fetch market data over plain HTTP from third-party endpoints, which exposes requests and responses to interception or modification by any network attacker on the path. Because this skill concerns financial data and may drive trading or alerting decisions, tampered quotes could mislead users or downstream automation even if no credentials are sent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 编辑 crontab crontab -e # 添加以下行（每天 9:30 执行） 30 9 * * * cd /root/.openclaw/workspace/skills/stock-portfolio/scripts && python3 daily_picks.py | openclaw message send --target your-chat-id
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation instructs users to schedule an automated pipeline that sends script output through
openclaw message sendto a chat target, but it does not clearly warn that this creates outbound transmission of generated content on a recurring basis. In a portfolio-management skill, that content could include holdings, recommendations, or other sensitive financial information, so the omission increases the risk of unintended data disclosure or notification abuse.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This example automatically sends messages whenever script output matches a warning indicator, again without an explicit privacy or safety warning about recurring outbound notifications. Because the trigger is based on script output and the command forwards message content automatically, users may unknowingly exfiltrate portfolio or alert data and create noisy or spoofable notifications if output is manipulated.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script claims recommendations are based on both technical indicators and fundamental screening, but the implemented scoring only uses price change, amplitude, and volume. In a stock-picking skill, this can mislead users about the rigor and nature of the recommendation process, causing them to place undue trust in outputs that do not match the stated methodology.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language description and all user-facing CLI/help/output strings are written in Chinese, indicating the skill is designed to operate in a single language by default. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language descriptions and CLI help/messages entirely in Chinese, starting with the module docstring and continuing throughout the command interface. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s description and all user-facing strings are in Chinese, including usage/help output, which effectively forces a specific language for interaction. The policy allows locale constraints only when users are given a choice or the limitation is clearly justified as region-specific, neither of which is present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 covers language or locale policy violations, including forcing a specific language without user opt-in. This file presents all instructions and examples in Chinese, with no indication that the skill is region-specific or that another language option is available.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The sample code and command invoke external services, but the surrounding documentation does not explicitly disclose that using them sends query data to third-party providers. For markdown under SQP-2, network behavior affecting privacy should be called out when describing how to use the skill or resource.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill documentation is written only in Chinese, with no indication that users may choose another language or that the locale restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The output states the picks are updated in real time during trading hours, but the daily random seed makes selection deterministic for a given date and can prevent intraday changes from being reflected in final recommendations. In a financial context, stale or falsely 'real-time' recommendations may cause users to act on outdated assumptions about market responsiveness.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language content in this file is entirely in Chinese, including the module docstring and inline documentation, with no indication that the skill is region-specific or that users may choose another language. Under the locale policy rule, forcing a specific language without opt-in can be a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file makes outbound network requests using a user-supplied symbol, transmitting that input to a third-party service. Although the module has internal docstrings describing data retrieval, there is no user-facing warning, confirmation, or visible log indicating that requests will be sent to external providers.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file performs an outbound HTTP request to Sina using the normalized user-provided symbol. The file lacks any visible confirmation prompt, user-facing log, or warning that user input is transmitted to an external service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code constructs an EastMoney API request containing the user-supplied symbol and sends it over the network. There is no user-facing disclosure in the file that external services are contacted or that query data leaves the local environment.
- Content