ClawHub
Back to skill

Security audit

A股新闻研报检索

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently performs disclosed Eastmoney finance searches, sends the user’s query to the expected API, and saves returned results locally for audit.

Install only if you intend to use Eastmoney MX search and are comfortable sending finance search queries to the configured Eastmoney endpoint. Configure MX_APIKEY deliberately, and set MX_OUTPUT_DIR if you want saved results kept somewhere specific.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'json_filename' from os.getenv (line 189, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
# 同时保存原始 JSON 结果
        json_filename = output_dir / f"mx_search_{safe_filename(query)}.json"
        with open(json_filename, "w", encoding="utf-8") as f:
            json.dump(result, f, ensure_ascii=False, indent=2)
        print(f"📄 原始结果已保存到: {json_filename}")
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'filename' from os.getenv (line 183, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
content = mx.extract_content(result)
        if content.strip():
            filename = output_dir / f"mx_search_{safe_filename(query)}.txt"
            with open(filename, "w", encoding="utf-8") as f:
                f.write(content)
            print(f"\n✅ 纯文本结果已保存到: {filename}")
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest frames this skill as using Eastmoney MX search for finance-specific information retrieval, which implies querying and returning results. In addition to search, the code creates directories and persists both extracted text and raw JSON results to disk, which is a materially broader behavior than simple retrieval/response formatting.

Context-Inappropriate Capability

Low
Confidence
81% confidence
Finding
The manifest only describes a finance-specific search skill and does not mention credential handling or environment-based secret access. While this may be convenient implementation-wise, reading MX_APIKEY from the environment is an additional capability that is not reflected in the declared purpose.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file’s natural-language interface and user-facing instructions are entirely in Chinese, including the skill description and command-line guidance, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
"query": query
        }
        
        response = requests.post(self.BASE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.