The skill is vulnerable to prompt injection, exposes internal
Claims to do
Noah Stock Market: 港股 / 美股只读市场数据 skill。通过公司内部证券 Open API 获取市场数据,并将原始结果整理成适合聊天场景阅读的结构化摘要。
Actually does
The skill executes Python scripts (`run_query.py`, `route_query.py`) to query market data for Hong Kong and US stocks. It retrieves an API key and base URL from `~/.openclaw/.secrets/noah-market.env` and contacts `https://securities-open-api.noahgroup.com`. It supports various read-only queries like stock snapshots, K-lines, capital flow, and financial data, using parameters defined in local YAML files.
openclaw skills install xuyun9160-lgtm/noah-stock-marketDeBERTa classifier detected prompt injection (confidence: 1.00)
The skill directly executes Python scripts (`scripts/run_query.py`) with user-controlled arguments. While enum validation is specified, the underlying script's robustness against shell injection or argument injection is critical and not guaranteed by this skill definition alone.
python3 scripts/run_query.py snapshot HK-00700 python3 scripts/run_query.py kline HK-00700 num=10 ktype=K_DAY
The skill relies on external files (`references/*.md`, `openapi.yaml`, `enum.yaml`, `entity.yaml`, `scripts/*.py`) for its logic and validation. Compromise or manipulation of these files during deployment or runtime could subvert the skill's intended behavior and security controls.
`references/openapi.yaml`、`references/enum.yaml`、`references/entity.yaml` 是本 skill 的协议源文件。`scripts/run_query.py`
The `NOAH_API_BASE_URL` is configurable via `~/.openclaw/.secrets/noah-market.env`. If an attacker can compromise the host environment and modify this file, they could redirect API calls to an attacker-controlled server, potentially leading to data exfiltration or other malicious actions.
NOAH_API_BASE_URL=https://securities-open-api.noahgroup.com
The '开发模式' (Development Mode) explicitly allows the agent to expose internal details like request parameters, return structures, and implementation logic. An attacker could social engineer the agent into this mode to extract sensitive information, potentially aiding further attacks.
当用户在开发、调试、设计或排查这个 skill 时,可以说明:- 使用了哪个接口 - 请求参数 - 返回结构 - 当前实现逻辑与已知问题
The agent is instructed to read various `references/*.md` files based on user intent. If these reference files themselves are compromised or contain malicious instructions, they could poison the agent's knowledge base or influence its reasoning.
先读取 `references/auth-and-preflight.md`,确认 API 配置与 token 读取方式。再根据用户意图,按需读取对应 reference
[](https://mondoo.com/ai-agent-security/skills/clawhub/xuyun9160-lgtm/noah-stock-market)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/xuyun9160-lgtm/noah-stock-market"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/xuyun9160-lgtm/noah-stock-market.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/xuyun9160-lgtm/noah-stock-market.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.