ClawHub
Back to skill

Security audit

A股自选股

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its watchlist-management purpose, but it can send ambiguous authenticated commands to an account-mutating endpoint without strong local safeguards.

Install only if you are comfortable giving the skill an Eastmoney API key that can query and change your personal watchlist. Use explicit query/add/delete commands with a clear stock code or name, avoid vague natural-language requests, and be aware it may read MX_APIKEY from a parent .env file and may over-report mutation success on inconsistent API responses.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
mx_zixuan.py:231
Finding

Ambiguous Input Defaults to an Account-Mutating API Operation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
mx_zixuan.py:177
Finding

Conflicting API Status Fields Can Be Reported as a Successful Mutation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'headers' from os.environ.get (line 73, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · mx_zixuan.py (reported line 64)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Tainted flow: 'headers' from os.environ.get (line 73, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · mx_zixuan.py (reported line 83)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · mx_zixuan.py (reported line 35)May include surrounding context.

python
apikey = os.environ.get("MX_APIKEY", "")
    if not apikey:
        # 尝试从.env文件读取
        env_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_file):
            try:
                with open(env_file, "r") as f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs execution of a local Python script that requires environment access (MX_APIKEY), performs networked API calls, and writes output files, but the manifest declares no explicit tool scope or permission boundaries. This creates an over-privileged integration risk: the runtime may grant broader capabilities than are obvious from the skill contract, making review, enforcement, and least-privilege controls harder.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mx_zixuan.py (reported line 64)May include surrounding context.

python
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mx_zixuan.py (reported line 83)May include surrounding context.

python
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Add/delete operations are executed immediately without any confirmation step, dry-run preview, or explicit warning. In a skill that modifies a user’s personal watchlist, ambiguous input or accidental invocation can cause unintended state changes, especially because the code also accepts natural-language management requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The fallback path forwards arbitrary natural-language input to the management endpoint whenever the text is not classified as a query. That expands behavior beyond the manifest’s explicit query/add/delete scope and can trigger unintended watchlist modifications from ambiguous phrasing or prompt-manipulated input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Natural-language strings throughout the file, including the module description and CLI help text, are exclusively in Chinese. This effectively forces a specific language for user interaction without any visible opt-in, alternative language support, or documented region-specific justification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

For a skill whose stated purpose is simply managing a personal watchlist, reading secrets from a parent-directory .env file is an extra capability not described in the manifest. This expands the skill’s local file access to credential discovery behavior that is not obviously required by the declared user-facing function.

Content

No source excerpt is available for this finding.