A Stock Analyst.Bak

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent A-share stock assistant, but it needs Review because it auto-installs unpinned dependent skills and can send sensitive stock/watchlist commands to an external financial API with limited scoping and confirmation.

Review the dependent skills before installing, since this package auto-installs them by name without pinned versions. Use it only if you are comfortable sending stock queries, screening criteria, news searches, and possible watchlist or monitoring commands to Eastmoney/DFCF using your API key, and confirm state-changing watchlist or alert actions manually.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Automatically Installed and Unpinned Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–13
Vulnerability Type: Unpinned automatic third-party Skill installation
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  {
    "openclaw":
      {
        "requires": 
          {
            "skills": ["mx-data", "mx-search", "mx-select-stock", "mx-selfselect", "stock-monitor-skill"],
            "action": "auto-install"
          },

Technical Analysis

The manifest directs the platform to automatically install five third-party Skills using mutable names, without declaring reviewed versions, immutable digests, package signatures, or a trusted source. These dependencies were not included in the audited project, so their implementations and instructions could not be reviewed.

This creates a supply-chain trust boundary outside the audited artifact. If a dependency publisher account, registry entry, or dependency-resolution mechanism is compromised, a malicious dependency could be delivered automatically when this Skill is installed. Because Agent Skills can contain executable scripts or agent-facing instructions, a compromised dependency could affect both local execution and Agent behavior.

The finding does not establish that any currently named dependency is malicious. The risk arises from automatic installation combined with the absence of immutable dependency controls.

Attack Path

1. An attacker compromises a dependency publisher, registry entry, or dependency-resolution source for one of the five named Skills.
2. The attacker publishes a modified package under the expected mutable dependency name.
3. The platform processes this manifest and resolves the dependency because action is set to auto-install.
4. The malicious package is installed without requiring review of the resolved artifact.
5. When loaded or invoked, malicious dependency code or instructions execute in the Agent's available context.
6. The dependency may then access data and tools availabl ...[truncated 818 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every Skill dependency to a reviewed, immutable version or content digest.
2. Resolve dependencies only through a trusted registry with verified publisher identities.
3. Require cryptographic signature and integrity verification before installation.
4. Replace unconditional automatic installation with an approval step that displays the exact resolved versions, publishers, permissions, and integrity identifiers.
5. Maintain a lockfile or equivalent signed dependency manifest and reject unexpected resolution changes.
6. Audit each dependency's instructions, executable files, network destinations, and transitive dependencies before deployment.
7. Apply least-privilege permissions and runtime sandboxing to all installed Skills.
8. Continuously monitor dependency ownership and integrity, and revoke versions whose publisher or registry provenance changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares automatic installation of dependent skills and clearly relies on network access and API-key-backed external data, but it does not declare an explicit tool/permission scope. That creates a least-privilege failure: the runtime may grant broader capabilities than users expect, and downstream skills with network or environment access may be invoked without clear authorization boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest includes very broad trigger keywords such as 理财, 副业, 投资, and 股票-related generic terms that can match ordinary conversation outside the user's intent to use this specific skill. Over-broad activation increases the chance the skill is selected unexpectedly, which is riskier here because it can pull external financial data, manage watchlists, and set monitoring actions through dependent skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Natural-language strings including the module description, class docstrings, and user-facing output are written only in Chinese, which effectively forces a specific language experience. The file does not indicate that the language is optional, configurable, or justified as a region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The methods send user-supplied stock queries, keywords, and self-select management commands to a third-party remote API, but the code provides no notice, consent flow, or minimization of what is transmitted. This can expose potentially sensitive investment interests or account-management intentions to the external service, especially for self-select operations that may reflect a user's portfolio behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This request transmits the raw user query to an external API endpoint. Even though HTTPS is used, the code performs no validation, redaction, or disclosure, so sensitive research terms or personal investment interests may be unnecessarily exposed to the third-party service.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 34)May include surrounding context.

python

data = {"toolQuery": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The stock screening method sends user-provided keywords directly to a third-party API without local filtering or privacy controls. This can leak proprietary watchlists, strategy terms, or personally revealing investment interests to the remote provider.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 46)May include surrounding context.

python

data = {"keyword": keyword, "pageNo": page, "pageSize": size}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This method transmits free-form self-select management commands to an external API, potentially affecting a user's watchlist or account-linked state. Because the command is opaque natural language and there is no confirmation, validation, or guardrail in this code, unintended or over-broad actions could be triggered and sensitive portfolio preferences disclosed.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 69)May include surrounding context.

python

data = {"query": query}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

News search keywords are sent directly to an external service, which can reveal user interests, holdings, or trading intentions. In a financial-analysis context, these search terms may be commercially sensitive, making undisclosed transmission more concerning than a generic search feature.

Content

Scanner excerpt · scripts/a_stock_analysis.py (reported line 81)May include surrounding context.

python

data = {"keyword": keyword, "pageNo": 1, "pageSize": 10}
        
        try:
            response = requests.post(url, json=data, headers=self.headers, timeout=30)
            return response.json()
        except Exception as e:
            return {"error": str(e)}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JSON file encodes all indicator names, descriptions, keywords, and analysis text exclusively in Chinese, with no alternative locale fields or indication that the skill is intentionally region-specific. Under the language/locale policy, hard-coding a single language without documented user choice or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.