etf-assistant
3 findings (1 high, 2 medium), mainly data exfiltration, command injection, prompt injection. Most recent scan 2026-02-06.
This ETF investment assistant skill presents MODERATE security risks primarily related to external network dependencies and input handling. The skill makes unvalidated HTTP requests to Yahoo Finance API and processes external data without proper validation, creating risks for data integrity and potential indirect prompt injection. Additionally, user inputs are not properly sanitized before being used in shell commands and URLs, creating command injection risks. However, the skill does not appear to contain intentionally malicious code, hardcoded credentials, or data exfiltration to attacker-controlled servers. The primary concerns are defensive security practices around external API integration and input validation. The skill would benefit from input sanitization, response validation, and explicit tool declarations in the manifest.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
ETF投资助理 / ETF Investment Assistant - 查询行情、筛选ETF、对比分析、定投计算。支持沪深300、创业板、科创50、纳指等主流ETF。
- Package
- 2 files, 13 KB
- SKILL.md
- 491 words, 12+ sections
- Code
- Shell (1)
SKILL.md covers: ETF投资助理 / ETF Investment Assistant · 功能特性 / Features · 使用方法 / Usage · 1. 查看ETF列表 / View ETF List · 2. 查询行情 / Query Quotes · 查询沪深300ETF · Query CSI 300 ETF · 查询创业板ETF · Query ChiNext ETF · 3. 热门ETF推荐 / Hot ETF Recommendations · 4. 搜索ETF / Search ETF · 按名称搜索
Findings
HIGH Unvalidated External Network Calls to Yahoo Finance API Data Exfiltrationllm
The skill makes HTTP requests to Yahoo Finance API (query1.finance.yahoo.com) without any validation, error handling, or security controls. While Yahoo Finance is a legitimate service, the skill does not validate responses, implement rate limiting, or handle potential data exfiltration risks. The API calls include user-provided ETF codes that are directly interpolated into URLs without sanitization, creating potential for URL manipulation. Additionally, the skill processes and displays external data without validation, which could be exploited for indirect prompt injection if the API response contains malicious content.
etf-assistant.sh
curl -s "https://query1.finance.yahoo.com/v8/finance/chart/${code}.SS?interval=1d&range=1d" | jq -r '.chart.result[0].meta | "当前价格: \(.regularMarketPrice) CNY\n涨跌幅: \(.regularMarketChangePercent)%"'MEDIUM Command Injection Risk via Unsanitized User Input Command Injectionllm
The skill accepts user input (ETF codes, search keywords, amounts) and directly interpolates them into shell commands and curl URLs without proper sanitization or validation. While the script uses some basic parameter handling, there is no input validation to prevent special characters or command injection attempts. For example, the 'search' command uses grep with user input, and the 'price' command interpolates codes directly into URLs. An attacker could potentially inject shell metacharacters to execute arbitrary commands.
etf-assistant.sh
cmd_search() { local keyword=$1; echo "$ETF_LIST" | grep -i "$keyword"; } and curl -s "https://query1.finance.yahoo.com/v8/finance/chart/${code}.SS?interval=1d&range=1d"MEDIUM Transitive Trust in External API Responses Prompt Injectionllm
The skill unconditionally trusts and processes data from Yahoo Finance API without validation. If the API is compromised or returns malicious content, the skill will process and display it to the user. The jq parsing and echo statements could potentially execute or display harmful content if the API response contains unexpected data structures or malicious payloads. This creates a transitive trust vulnerability where the skill delegates trust to an external, uncontrolled data source.
etf-assistant.sh
curl -s "https://query1.finance.yahoo.com/v8/finance/chart/${code}.SS" | jq -r '.chart.result[0].meta | ...' - No validation of response structure or content before processingWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.7 KB |
etf-assistant.sh | script | 9.3 KB |
External hosts referenced
query1.finance.yahoo.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/etf-assistant
- Raw scan result: etf投资助理-scan.json
- Badge for your README:
- Request a re-scan