The skill is vulnerable to prompt injection via user queries and path traversal through an insecure output directory, risking data manipulation and system compromise.
Claims to do
选股 / 选板块 / 选基金: 通过**自然语言查询**进行选股,数据来自于妙想大模型服务,支持以下类型: - **A股**、**港股**、**美股** - **基金**、**ETF**、**可转债**、**板块**
Actually does
This skill executes a Python script (`get_data.py`) to query the Eastmoney Miaoxiang service API (`https://ai.eastmoney.com/mxClaw`) using a provided `EM_API_KEY`. It takes natural language queries and asset types as input, then outputs the results as local CSV and description text files. It requires `httpx` to be installed.
openclaw skills install financial-ai-analyst/mx-stocks-screenerThe skill accepts a user-controlled natural language query (`--query` parameter) which is processed by an underlying large language model service. This input can be exploited for prompt injection to manipulate the model's behavior, extract unintended information, or bypass security controls.
python3 {baseDir}/scripts/get_data.py --query "..." --select-type A股
数据来自于妙想大模型服务The `MX_STOCKS_SCREENER_OUTPUT_DIR` environment variable allows users to specify an arbitrary output directory. Without proper path validation, this could potentially be abused for path traversal or to write files to unintended system locations, leading to resource abuse or data overwrite.
export MX_STOCKS_SCREENER_OUTPUT_DIR="/path/to/output"
[](https://mondoo.com/ai-agent-security/skills/clawhub/financial-ai-analyst/mx-stocks-screener)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/financial-ai-analyst/mx-stocks-screener"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/financial-ai-analyst/mx-stocks-screener.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/financial-ai-analyst/mx-stocks-screener.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.