The stock price query skill is vulnerable to prompt injection,
Claims to do
Stock Price Query Skill: 实时股票行情与大盘指数查询技能,覆盖 **A 股(沪深两市)**、**港股**、**美股**三大市场。支持**单只查询**和**批量查询**(一次查询多只股票对比),轻量无依赖,无需 API Key,适合聊天场景下的快速股价查询——秒级获取当前价格、涨跌幅、开高低收、成交量等行情数据。
Actually does
This skill executes a Python script (`stock_query.py`) using `python3`. It takes stock codes (single or comma-separated for batch) and an optional market identifier as arguments. The script is designed to query real-time stock data for A-shares, Hong Kong, and US markets, including indices, by contacting unspecified 'free public market APIs' over the network.
openclaw skills install tjefferson/stock-price-queryDeBERTa classifier detected prompt injection (confidence: 0.97)
[](https://mondoo.com/ai-agent-security/skills/clawhub/tjefferson/stock-price-query)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/tjefferson/stock-price-query"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/tjefferson/stock-price-query.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/tjefferson/stock-price-query.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.