ClawHub
Back to skill

Security audit

A股自选股

Security checks across malware telemetry and agentic risk

Overview

The skill is generally aligned with managing an Eastmoney watchlist, but it can change account data through a remote API and its mutation path is broader than the written instructions describe.

Review before installing if you are not comfortable giving the skill an Eastmoney API key and authority to add or delete items in your watchlist. Use it only for explicit watchlist operations, avoid vague natural-language mutation requests, and prefer setting MX_APIKEY directly rather than relying on a .env file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tainted flow: 'headers' from os.environ.get (line 73, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:
Confidence
90% confidence
Finding
response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)

Tainted flow: 'headers' from os.environ.get (line 73, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:
Confidence
90% confidence
Finding
response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest says to use this skill only when the user explicitly asks to query, add, or delete stocks from their self-selected watchlist. In the fallback branch, any input not recognized as a query is forwarded verbatim to the remote manage endpoint, which broadens behavior from explicit add/delete intents to unspecified natural-language management operations accepted by the backend.

Context-Inappropriate Capability

Low
Confidence
87% confidence
Finding
Managing a personal watchlist requires authentication, so using an API key is expected, but traversing to and reading a parent-directory .env file is an additional credential-discovery capability not described in the manifest. This expands the skill beyond straightforward watchlist operations into local secret-file access.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code performs a potentially destructive account-modification action by sending a delete instruction to the remote self-select management API, but there is no confirmation prompt before the request is sent. While the success/failure is printed afterward, the user is not warned or asked to confirm the irreversible change prior to execution.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The module description, command help, and user-facing messages are written exclusively in Chinese, which imposes a specific language without any visible opt-in or alternative. Under the stated policy, language-specific behavior should either offer user choice or clearly document a justified locale constraint.

External Transmission

Medium
Category
Data Exfiltration
Content
}
    
    try:
        response = requests.post(QUERY_URL, headers=headers, json={}, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:
Confidence
80% confidence
Finding
requests.post(QUERY_URL, headers=headers, json=

External Transmission

Medium
Category
Data Exfiltration
Content
}
    
    try:
        response = requests.post(MANAGE_URL, headers=headers, json=data, timeout=30)
        response.raise_for_status()
        return response.json()
    except Exception as e:
Confidence
80% confidence
Finding
requests.post(MANAGE_URL, headers=headers, json=

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def get_apikey() -> str:
    """从环境变量获取apikey"""
    apikey = os.environ.get("MX_APIKEY", "")
    if not apikey:
        # 尝试从.env文件读取
        env_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
Confidence
70% confidence
Finding
os.environ.get("MX_APIKEY

Credential Access

High
Category
Privilege Escalation
Content
apikey = os.environ.get("MX_APIKEY", "")
    if not apikey:
        # 尝试从.env文件读取
        env_file = os.path.join(os.path.dirname(os.path.dirname(__file__)), ".env")
        if os.path.exists(env_file):
            try:
                with open(env_file, "r") as f:
Confidence
60% confidence
Finding
.env"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.