The skill risks command injection by passing uns
Claims to do
宏观经济数据查询 (mx_macro_data): 通过**文本输入**查询宏观经济数据,接口返回 JSON 后会自动转换为 **CSV** 并生成对应的**内容描述 txt** 文件。
Actually does
This skill executes a Python script (`scripts/get_data.py`) that uses the `httpx` library to query an external macroeconomic data API from Eastmoney, requiring an `EM_API_KEY`. It takes a natural language query, processes the API's JSON response, and outputs the data as one or more CSV files and a descriptive TXT file to a local directory.
openclaw skills install financial-ai-analyst/mx-macro-dataThe skill mandates a complex, multi-stage '完整性复核' (integrity verification) workflow for the orchestrator, including iterative calls to the skill and internal code execution (e.g., Python Sandbox) to read and analyze generated CSVs. This dictates the orchestrator's decision-making, resource usage, and forces internal code execution.
上层规划引擎在调用 `mx_macro_data` 后,**必须**执行以下工作流... 使用规划引擎内置的代码执行能力(如 Python Sandbox)读取 CSV。⚠️ **强制要求**:上层规划引擎**必须**执行以下补全流程...
The skill's command line invocation passes user-controlled query input to a Python script (`get_data.py`). If this script internally uses `shell=True` with unsanitized input when executing system commands, it could lead to command injection.
python3 {baseDir}/scripts/get_data.py --query 中国GDP[](https://mondoo.com/ai-agent-security/skills/clawhub/financial-ai-analyst/mx-macro-data)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/financial-ai-analyst/mx-macro-data"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/financial-ai-analyst/mx-macro-data.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/financial-ai-analyst/mx-macro-data.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.