Skills/ClawHub/stock-tracker

stock-tracker@2.2.0

CAUTION· static only

Publisher claims: "东方财富自选股公告追踪。三级过滤 + LLM分类摘要 + Web仪表盘，支持 agent 定时推送。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher 54lynnn · publishing for 167 daysInstalls 1,073Last detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-12 and scored it 58/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; document.cookie access. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsscripts/setup.sh:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env（LLM API Key）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_manager.py:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = os.path.join(temp_config_dir, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/llm_judge.py:281 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"LLM 已启用但 .env 中未配置 LLM_API_KEY，已自动禁用"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accessscripts/setup.sh:60 · document.cookie access — can steal session cookiesecho " 请登录东方财富网页版后，按 F12 → Console → copy(document.cookie) 到:"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_config_manager.py:164 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = os.path.join(temp_config_dir, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " [提示] .env 不存在，正在创建空白模板..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/reclassify_all.py:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslogger.error("LLM 未启用，请检查 .env 中的 LLM_API_KEY")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 3. 提示配置 cookie.txt、.env、config.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "# Stock Tracker LLM 配置" > "$SKILL_DIR/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_manager.py:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 确保没有.env文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/llm_judge.py:263 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesapi_key 优先从 .env 文件读取（LLM_API_KEY 变量），Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/config_manager.py:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path: str = os.path.join(SKILL_DIR, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f "$SKILL_DIR/.env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env 文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_manager.py:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = os.path.join(temp_config_dir, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "LLM_API_KEY=sk-your-api-key" > .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accessSKILL.md:120 · document.cookie access — can steal session cookies2. F12 → Console → 输入 `copy(document.cookie)` 回车Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
document.cookie accessscripts/refresh_cookie.py:118 · document.cookie access — can steal session cookieslogger.warning(" → F12 → Console → copy(document.cookie)")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈881 tok
1 file · 40 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

22 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim 54lynnn: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim 54lynnnPropose a patch to the maintainer