Security audit

astock-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Chinese A-share research template, but it ships an executable quote script with an exposed API key and weak input handling.

Review this before installing. The main issue is not destructive local behavior; it is the bundled API key and the fact that the script sends stock codes to an external market-data service. The publisher should remove and rotate the exposed key, require users to supply their own credential securely, validate stock-code input, and make clear that outputs are research support rather than personalized financial advice.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/get_stock.sh:11
Finding: Hard-Coded QVeris API Credential in Distributed Script
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi export QVERIS_API_KEY ``` 5. Never include the replacement key in source code, documentation, examples, logs, or package metadata. 6. Apply least privilege to the replacement key, including endpoint restrictions, rate limits, expiration, and network restrictions where supported. 7. Review API access logs for unauthorized activity involving the exposed credential. 8. Add secret scanning to local hooks and CI/CD pipelines to prevent recurrence. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get_stock.sh:3
Finding: Unvalidated Stock Code Is Interpolated into JSON Request Parameters
Content: View full analysis
" echo "示例: ./get_stock.sh 000001.SZ" exit 1 fi echo "=== 查询 $CODE 实时行情 ===" export QVERIS_API_KEY=sk-[REDACTED_EXPOSED_API_KEY] ~/.local/bin/uv run /home/ubuntu/.openclaw/workspace/skills/qveris/scripts/qveris_tool.py execute ths_ifind.real_time_quotation.v1 \ --search-id "9869fb66-3bc7-4c4d-854f-4bedc22d3b10" \ --params "{\"codes\": \"$CODE\"}" 2>&1 ``` The credential value has been redacted from this report because it is independently reported as an exposed secret. ### Technical Analysis The first positional argument is accepted without validating that it conforms to the expected stock-code format. It is then inserted directly into a hand-built JSON string without JSON escaping or serialization. An input containing a double quote, backslash, or JSON syntax can terminate or alter the intended `codes` string. Depending on how `qveris_tool.py` parses and validates the resulting data, this can produce malformed JSON or introduce additional JSON fields into the request. This construction does not establish direct shell-command injection: the variable expansion remains inside a double-quoted shell argument, so shell metacharacters introduced through `CODE` are not reparsed as shell syntax. The confirmed weakness is request-parameter manipulation and denial of the intended request through unsafe JSON construction. ### Attack Path 1. An attacker gains the ability to invoke the script or influence its first argument. 2. The attacker supplies a value containing quotation marks and JSON tokens rather than a valid stock code. 3. The script concatenates the value into the `--params` JSON argument without escaping it. 4. The downstream QVeris wrapper receives malformed or st ...[truncated 918 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Construct JSON with a serializer rather than string concatenation: ```bash PARAMS=$(jq -cn --arg codes "$CODE" '{codes: $codes}') || exit 1 ~/.local/bin/uv run \ /home/ubuntu/.openclaw/workspace/skills/qveris/scripts/qveris_tool.py \ execute ths_ifind.real_time_quotation.v1 \ --search-id "9869fb66-3bc7-4c4d-854f-4bedc22d3b10" \ --params "$PARAMS" ``` 3. If `jq` is unavailable, use a trusted JSON serializer in Python rather than implementing manual escaping. 4. Enforce the same stock-code schema in the downstream wrapper or API so that client-side validation is not the only control. 5. Avoid merging standard error into standard output unless required, because doing so can make downstream parsing and error detection unreliable. 6. Add tests covering quotation marks, backslashes, control characters, oversized arguments, invalid exchange suffixes, and multiple-code input. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a comprehensive A-share investment research framework with analysis across macro/micro fundamentals, capital flows, technicals, sentiment, and news, aimed at producing deep analysis and trading plans. The provided code does not implement such a framework. Instead, it is a narrow utility script for querying real-time market quotes for a single stock code via an external API. This is a materially different and much more limited behavior than the declared purpose. Additionally, the script hardcodes and exports an API key and invokes an external qveris/ths_ifind data service, which is an externally accessed capability not disclosed in the declared permissions. Therefore, the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes and exports a live external API credential directly in source code. This exposes the secret to anyone who can read the file, shell history, logs, process environment, or downstream child processes, enabling unauthorized use of the external service and potential abuse billed to the owner.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Exporting a hardcoded API key without warning or disclosure is a real secret-handling flaw, not just a UX issue. The export makes the credential available to subprocesses and increases the chance of accidental leakage through debugging output, crash reports, environment inspection, or unrelated child commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill gives concrete trading outputs such as rating, position sizing, and entry/add-position price ranges without an explicit warning that the output is not financial advice and may lead to financial loss. In a financial-decision context, users may over-trust the model and act on recommendations without understanding uncertainty, suitability, or risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language title, usage text, and status output are all hardcoded in Chinese, with no option for the user to select another language and no documented justification for a Chinese-only locale. This creates a language policy issue because the skill imposes a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The script executes an external tool that calls a remote API using the provided stock code and search identifier, but the user is only told that a quote query is being performed. There is no explicit warning or disclosure that input data is being transmitted to an external service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language instructions and descriptions are fully Chinese-language, and the file does not indicate that the user can choose another language or that the skill is intentionally restricted to Chinese-language operation. This can violate language/locale policy when a skill forces a language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest description is written entirely in Chinese and targets 'A股' analysis, which indicates a China-specific language/locale assumption. There is no accompanying note that the skill is region-specific by design or any indication that users can choose another language or locale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.