ClawHub
Back to skill

Security audit

Mx Finance Data 1.0.8

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Eastmoney financial-data skill that uses an API key to fetch data and write local Excel/text reports, with dependency and spreadsheet-safety caveats.

Install only if you trust Eastmoney's API service and are comfortable storing an EM_API_KEY locally. Prefer installing dependencies in a virtual environment, and open generated spreadsheets with normal caution for files containing remote financial data, especially external links or formulas.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:10-17 and SKILL.md:123-125
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

json
"install": [
  {
    "id": "pip-deps",
    "kind": "python",
    "package": "httpx pandas openpyxl",
    "label": "Install Python dependencies"
  }
]
bash
pip3 install httpx pandas openpyxl --user

Technical Analysis

The Skill installs httpx, pandas, and openpyxl without fixed versions or cryptographic integrity hashes. Consequently, each installation resolves whatever versions are available from the configured Python package index at that time.

This prevents reproducible dependency resolution and exposes users to upstream package compromise, malicious replacement releases, dependency-resolution changes, and unexpected security regressions. The use of --user also places these packages in the user's Python environment rather than an isolated project environment, potentially affecting other Python applications run by the same account.

No evidence indicates that the currently named packages are malicious. The vulnerability is the absence of controls ensuring that the versions installed in the future are the versions that were reviewed.

Attack Path

  1. An attacker compromises an upstream package account, package distribution channel, or package-index configuration.
  2. The attacker publishes a malicious version of one of the unpinned packages or a transitive dependency.
  3. A user installs the Skill dependencies using the documented command or automatic installation metadata.
  4. pip resolves and installs the attacker-controlled release.
  5. Malicious installation or runtime code executes with the privileges of the user installing or invoking the Skill.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the installing user's privileges. This may permit ...[truncated 443 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version, such as httpx==X.Y.Z.
  2. Generate a lock file that also fixes all transitive dependency versions.
  3. Require cryptographic hashes during installation, for example with a hash-locked requirements file and pip install --require-hashes.
  4. Install dependencies in a dedicated virtual environment rather than with --user.
  5. Use a trusted package index and prevent untrusted index URLs from overriding dependency resolution.
  6. Add automated dependency vulnerability and provenance scanning to the release process.
  7. Review and deliberately update the lock file rather than automatically consuming newly published releases.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/get_data.py:430
Finding

Untrusted API Values Can Be Written as Executable Spreadsheet Formulas

Content
View full analysis

Vulnerability Details

File Location: scripts/get_data.py:89-98 and scripts/get_data.py:430-432
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

Remote API values are converted to strings without spreadsheet-specific escaping:

python
def _normalize_values(raw_values: List[Any], expected_len: int) -> List[str]:
    """
    规范化一行指标值长度与类型。
    先将原始值转字符串，再按列数补空或截断。
    返回长度固定的字符串列表。
    """
    values = [_flatten_value(v) for v in raw_values]
    if len(values) < expected_len:
        values.extend([""] * (expected_len - len(values)))
    return values[:expected_len]

Those values are then written directly to XLSX worksheets:

python
with pd.ExcelWriter(file_path, engine="openpyxl") as writer:
    for table in tables:
        df = pd.DataFrame(table["rows"], columns=table["fieldnames"])
        df.to_excel(writer, sheet_name=table["sheet_name"], index=False)

Technical Analysis

Values received from the remote financial-data API are flattened and inserted into a Pandas DataFrame without neutralizing spreadsheet formulas. With the openpyxl engine, a string beginning with = can be serialized as a formula cell rather than inert text.

An attacker who can influence the API response could therefore inject spreadsheet formulas into data values, labels, headers, entity names, or other fields that reach the generated workbook. The formula may be evaluated when a user opens the XLSX file.

Formula behavior depends on the spreadsheet client and its security settings. Possible payloads include deceptive calculations, hyperlinks, or formulas that initiate external resource requests. More severe effects, such as command execution, generally require vulnerable legacy spreadsheet functionality, unsafe client configuration, or additional user interaction and should not be assumed universally.

Attack Path

  1. An attacker compromises ...[truncated 1385 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every API-provided worksheet value, header, and label as untrusted.
  2. Before constructing the DataFrame, detect strings whose first non-whitespace character is =, +, -, or @.
  3. Prefix suspicious values with an apostrophe or otherwise force them to be stored explicitly as text.
  4. Apply the protection centrally so it covers values, column names, indicator labels, entity names, and other remote fields.
  5. Consider writing cells through openpyxl with an explicit text data type where appropriate.
  6. Add tests confirming that payloads such as =1+1 remain literal text after the generated workbook is reopened.
  7. Document that generated workbooks contain remote data and should be opened with external-content and legacy formula execution disabled.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requires environment access, network access, and writes output files, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where the runtime may grant broader capabilities than users or reviewers expect, increasing the risk of unintended data access, outbound requests, or file creation if the skill behavior changes or is abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language descriptions and CLI help text that assume Chinese as the only user language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description contains both Chinese and English content, but the document does not state whether users may choose their preferred language or locale for interaction and outputs. Under the language/locale policy rule, forcing or implicitly assuming a language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.