ClawHub
Back to skill

Security audit

Fundamental Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated A-share analysis purpose, but it directs agents to use unencrypted financial-data URLs for investment-oriented reports.

Review before installing if you may rely on the output for financial decisions. Use secure HTTPS sources where available, verify key figures against official filings or a second trusted source, and treat the generated buy/sell-style suggestions as research support rather than financial advice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:93
Finding

Financial data retrieved over unencrypted HTTP connections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–94, 120–121, 169, and 174
Vulnerability Type: Plaintext transport of decision-critical financial data
Risk Level: Medium

Vulnerable Code

python
# URL format: http://f10.eastmoney.com/cwfx.html?code=sh600519
response = await web_fetch("http://f10.eastmoney.com/cwfx.html?code=sh600519")
markdown
| East Money annual-report page | `http://f10.eastmoney.com/ccbgg.html?code=sh600519` |
| CNINFO annual reports | `http://www.cninfo.com.cn/new/disclosure/stock?stockCode=600519` |
python
f10_url = f"http://f10.eastmoney.com/cwfx.html?code=sh{stock_code}"
raw_page = await web_fetch(f10_url)

industry_data = await web_fetch(
    f"http://push2.eastmoney.com/api/qt/clist/get?...industry={industry_code}"
)

Technical Analysis

The Skill explicitly instructs the agent to retrieve financial statements, company data, and industry comparisons through plaintext HTTP endpoints. HTTP provides neither transport encryption nor reliable server authentication and does not protect response integrity.

An attacker able to observe or modify network traffic—such as a compromised proxy, malicious access point, ISP-level intermediary, or adversary on the local network—could replace financial values or the entire response. The workflow may then treat the modified data as authoritative and use it to calculate PE, PB, ROE, margins, debt ratios, and valuation conclusions.

Network access is necessary for the declared fundamental-analysis functionality, but plaintext transport is not the minimum safe privilege or communication mechanism required. HTTPS endpoints should be used instead.

Attack Path

  1. A user requests fundamental analysis of an A-share company.
  2. The agent follows the documented workflow and requests one of the listed HTTP endpoints.
  3. A network-positioned attacker intercepts the unencrypted request.
  4. The attacke ...[truncated 1306 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace every http:// endpoint with the provider's verified https:// equivalent.
  2. Configure the retrieval mechanism to reject redirects that downgrade an HTTPS request to HTTP.
  3. Permit only expected HTTPS hosts, including the exact official domains required by the Skill.
  4. Validate response status, content type, schema, and required fields before using returned values.
  5. Apply sanity checks to financial values, including valid numeric ranges, reporting dates, units, and stock-code consistency.
  6. Cross-check decision-critical figures against a second independent source delivered over HTTPS.
  7. Record the source URL, retrieval date, reporting period, and any discrepancies in the generated report.
  8. Fail safely when secure transport or validation is unavailable rather than silently using unverified data.
  9. Review the currently documented providers to confirm that their HTTPS endpoints are official and supported before updating the examples.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The title and core description are presented as an A-share analysis skill in Chinese, and the examples/output format throughout the document assume Chinese-language requests and Chinese report generation. There is no explicit opt-in or alternative language option, which can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.