Skill Trust Decision

slzq-trading

Name: slzq-trading Trust Review Report
Item: slzq-trading
Rating: 80
Author: ClawSafe

三立期货官方量化交易技能，代码行为与声明一致，无恶意特征；安装脚本需shell:WRITE但已声明用途并有锁定机制。

Install decision first Source: ClawHub Scanned: Sep 8, 2026

Files 57

Artifacts 109

Violations 2

Findings 4

Why this conclusion was reached

1/4 dimensions flagged

Block

Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

109 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

4 dependency or supply-chain issues need attention.

What drove the risk score up

安装脚本调用shell执行npm/CLI命令 +15

install/setup-clawhub.mjs使用spawnSync执行npm ci和openclaw mcp add，虽在文档MCP注册章节说明但未在frontmatter declared-tools中声明

凭证文件写入用户家目录 +5

runtime/mcp/src/index.ts写入~/.slzq-trading/credentials.json和~/.openclaw/openclaw.json，有原子写保护但路径未在文档声明

Most important evidence

Low Priv Escalation

安装脚本未在声明工具集中声明shell执行

setup-clawhub.mjs通过spawnSync执行npm ci安装依赖、openclaw mcp add注册MCP。这需要shell:WRITE权限但SKILL.md frontmatter的declared-tools未包含Bash/Write。文档在MCP注册章节有说明，属于部分声明。

install/setup-clawhub.mjs:42

在SKILL.md frontmatter declared-tools中添加 Bash→shell:WRITE 或在MCP安装说明中更醒目标注此权限需求

Low Supply Chain

package.json依赖未锁小版本

@modelcontextprotocol/sdk使用^1.29.0、zod使用^4.3.6，允许次版本更新，虽有package-lock.json固定但package.json本身非锁定。npm ci仍会使用lock文件，整体可接受。

runtime/mcp/package.json:22

考虑使用精确版本如"1.29.0"以完全消除供应链风险

Info Sensitive Access

凭证文件写入家目录

MCP将API密钥写入~/.slzq-trading/credentials.json（0600权限）和~/.openclaw/openclaw.json。原子写保护实现正确，但写入路径在文档中说明不足。

runtime/mcp/src/index.ts:88

在文档中明确说明密钥存储位置和权限模型

Info Doc Mismatch

资产文件含加密货币钱包地址

assets/kefu-qrcode.base64.txt中含加密货币钱包地址1cPzW7TNRXXg66oTg66KN6Kxrjz1p，base64编码存储。位于只读资产文件，非执行路径，实际风险低。

assets/kefu-qrcode.base64.txt:1

确认该地址为三立期货官方客服收款渠道（非恶意基础设施）

Declared capability vs actual capability

Filesystem Block

Declared READ

→

Inferred WRITE

runtime/mcp/src/index.ts:88-115 写入~/.slzq-trading/credentials.json

Network Pass

Declared READ

→

Inferred READ

所有请求仅发往 https://slzqapi.sxslqhsh.com

Shell Block

Declared NONE

→

Inferred WRITE

install/setup-clawhub.mjs:42 spawnSync('npm',['ci'])

Environment Pass

Declared READ

→

Inferred READ

runtime/mcp/src/index.ts 读取SLZQ_OPENCLAW_DOMAIN/API_KEY/ENV

Suspicious artifacts and egress

Medium External URL

https://slzqapi.sxslqhsh.com

SKILL.md:44

Medium External URL

https://www.sxslqh.com/

SKILL.md:139

Medium External URL

https://work.weixin.qq.com/ca/cawcde585f7474b3f7

assets/README.md:5

Medium Wallet Address

1cPzW7TNRXXg66oTg66KN6Kxrjz1p

assets/kefu-qrcode.base64.txt:1

Medium External URL

https://slzqapi.sxslqhsh.com/mobile-api（$

install/doctor.sh:55

Medium External URL

https://slzqapi.sxslqhsh.com/mobile-api/static/page/openclaw-agreement

references/api-auth.md:56

Medium External URL

https://www.sxslqh.com/Introduction/26.html

references/company-faq.md:15

Medium External URL

https://www.sxslqh.com/，

references/company-faq.md:72

Medium External URL

https://slzqapi.sxslqhsh.com/mobile-api

references/usage-notes.md:12

Medium External URL

https://slzqapi.sxslqhsh.com），但结尾不要写

references/usage-notes.md:67

Medium External URL

https://主机名/sanli

references/usage-notes.md:174

Medium External URL

https://clawhub.ai/upload

references/usage-notes.md:372

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
@modelcontextprotocol/sdk	`^1.29.0`	npm	No	使用^允许次版本更新，有package-lock.json固定
zod	`^4.3.6`	npm	No	同^允许更新，有lock固定
hono	`4.12.11`	npm	No	npm ci时使用lock固定版本
express	`5.2.1`	npm	No	间接依赖，lock固定

File composition

57 files · 11952 lines

Markdown 18 files · 3121 linesYAML 10 files · 2823 linesJSON 14 files · 2739 linesTypeScript 2 files · 1592 linesJavaScript 6 files · 1403 linesShell 3 files · 267 lines

Files of concern · 6

runtime/mcp/src/index.ts TypeScript · 1590 lines

凭证文件写入家目录

runtime/mcp/dist/index.js JavaScript · 1129 lines

https://host/sanli）

references/usage-notes.md Markdown · 505 lines

https://slzqapi.sxslqhsh.com/mobile-api · https://slzqapi.sxslqhsh.com），但结尾不要写 · https://主机名/sanli · https://clawhub.ai/upload

runtime/mcp/package-lock.json JSON · 1178 lines

https://registry.npmmirror.com/@hono/node-server/-/node-server-1.19.12.tgz · https://registry.npmmirror.com/@modelcontextprotocol/sdk/-/sdk-1.29.0.tgz · https://registry.npmmirror.com/@types/node/-/node-25.5.2.tgz · https://registry.npmmirror.com/accepts/-/accepts-2.0.0.tgz · https://registry.npmmirror.com/ajv/-/ajv-8.18.0.tgz · https://registry.npmmirror.com/ajv-formats/-/ajv-formats-3.0.1.tgz · https://registry.npmmirror.com/body-parser/-/body-parser-2.2.2.tgz · https://opencollective.com/express · https://registry.npmmirror.com/bytes/-/bytes-3.1.2.tgz · https://registry.npmmirror.com/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz · https://registry.npmmirror.com/call-bound/-/call-bound-1.0.4.tgz · https://registry.npmmirror.com/content-disposition/-/content-disposition-1.0.1.tgz · https://registry.npmmirror.com/content-type/-/content-type-1.0.5.tgz · https://registry.npmmirror.com/cookie/-/cookie-0.7.2.tgz · https://registry.npmmirror.com/cookie-signature/-/cookie-signature-1.2.2.tgz · https://registry.npmmirror.com/cors/-/cors-2.8.6.tgz · https://registry.npmmirror.com/cross-spawn/-/cross-spawn-7.0.6.tgz · https://registry.npmmirror.com/debug/-/debug-4.4.3.tgz · https://registry.npmmirror.com/depd/-/depd-2.0.0.tgz · https://registry.npmmirror.com/dunder-proto/-/dunder-proto-1.0.1.tgz · https://registry.npmmirror.com/ee-first/-/ee-first-1.1.1.tgz · https://registry.npmmirror.com/encodeurl/-/encodeurl-2.0.0.tgz · https://registry.npmmirror.com/es-define-property/-/es-define-property-1.0.1.tgz · https://registry.npmmirror.com/es-errors/-/es-errors-1.3.0.tgz · https://registry.npmmirror.com/es-object-atoms/-/es-object-atoms-1.1.1.tgz · https://registry.npmmirror.com/escape-html/-/escape-html-1.0.3.tgz · https://registry.npmmirror.com/etag/-/etag-1.8.1.tgz · https://registry.npmmirror.com/eventsource/-/eventsource-3.0.7.tgz · https://registry.npmmirror.com/eventsource-parser/-/eventsource-parser-3.0.6.tgz · https://registry.npmmirror.com/express/-/express-5.2.1.tgz · https://registry.npmmirror.com/express-rate-limit/-/express-rate-limit-8.3.2.tgz · https://registry.npmmirror.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz · https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.0.tgz · https://opencollective.com/fastify · https://registry.npmmirror.com/finalhandler/-/finalhandler-2.1.1.tgz · https://registry.npmmirror.com/forwarded/-/forwarded-0.2.0.tgz · https://registry.npmmirror.com/fresh/-/fresh-2.0.0.tgz · https://registry.npmmirror.com/function-bind/-/function-bind-1.1.2.tgz · https://registry.npmmirror.com/get-intrinsic/-/get-intrinsic-1.3.0.tgz · https://registry.npmmirror.com/get-proto/-/get-proto-1.0.1.tgz · https://registry.npmmirror.com/gopd/-/gopd-1.2.0.tgz · https://registry.npmmirror.com/has-symbols/-/has-symbols-1.1.0.tgz · https://registry.npmmirror.com/hasown/-/hasown-2.0.2.tgz · https://registry.npmmirror.com/hono/-/hono-4.12.11.tgz · https://registry.npmmirror.com/http-errors/-/http-errors-2.0.1.tgz · https://registry.npmmirror.com/iconv-lite/-/iconv-lite-0.7.2.tgz · https://registry.npmmirror.com/inherits/-/inherits-2.0.4.tgz · https://registry.npmmirror.com/ip-address/-/ip-address-10.1.0.tgz · https://registry.npmmirror.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz · https://registry.npmmirror.com/is-promise/-/is-promise-4.0.0.tgz · https://registry.npmmirror.com/isexe/-/isexe-2.0.0.tgz · https://registry.npmmirror.com/jose/-/jose-6.2.2.tgz · https://registry.npmmirror.com/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz · https://registry.npmmirror.com/json-schema-typed/-/json-schema-typed-8.0.2.tgz · https://registry.npmmirror.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz · https://registry.npmmirror.com/media-typer/-/media-typer-1.1.0.tgz · https://registry.npmmirror.com/merge-descriptors/-/merge-descriptors-2.0.0.tgz · https://registry.npmmirror.com/mime-db/-/mime-db-1.54.0.tgz · https://registry.npmmirror.com/mime-types/-/mime-types-3.0.2.tgz · https://registry.npmmirror.com/ms/-/ms-2.1.3.tgz · https://registry.npmmirror.com/negotiator/-/negotiator-1.0.0.tgz · https://registry.npmmirror.com/object-assign/-/object-assign-4.1.1.tgz · https://registry.npmmirror.com/object-inspect/-/object-inspect-1.13.4.tgz · https://registry.npmmirror.com/on-finished/-/on-finished-2.4.1.tgz · https://registry.npmmirror.com/once/-/once-1.4.0.tgz · https://registry.npmmirror.com/parseurl/-/parseurl-1.3.3.tgz · https://registry.npmmirror.com/path-key/-/path-key-3.1.1.tgz · https://registry.npmmirror.com/path-to-regexp/-/path-to-regexp-8.4.2.tgz · https://registry.npmmirror.com/pkce-challenge/-/pkce-challenge-5.0.1.tgz · https://registry.npmmirror.com/proxy-addr/-/proxy-addr-2.0.7.tgz · https://registry.npmmirror.com/qs/-/qs-6.15.0.tgz · https://registry.npmmirror.com/range-parser/-/range-parser-1.2.1.tgz · https://registry.npmmirror.com/raw-body/-/raw-body-3.0.2.tgz · https://registry.npmmirror.com/require-from-string/-/require-from-string-2.0.2.tgz · https://registry.npmmirror.com/router/-/router-2.2.0.tgz · https://registry.npmmirror.com/safer-buffer/-/safer-buffer-2.1.2.tgz · https://registry.npmmirror.com/send/-/send-1.2.1.tgz · https://registry.npmmirror.com/serve-static/-/serve-static-2.2.1.tgz · https://registry.npmmirror.com/setprototypeof/-/setprototypeof-1.2.0.tgz · https://registry.npmmirror.com/shebang-command/-/shebang-command-2.0.0.tgz · https://registry.npmmirror.com/shebang-regex/-/shebang-regex-3.0.0.tgz · https://registry.npmmirror.com/side-channel/-/side-channel-1.1.0.tgz · https://registry.npmmirror.com/side-channel-list/-/side-channel-list-1.0.0.tgz · https://registry.npmmirror.com/side-channel-map/-/side-channel-map-1.0.1.tgz · https://registry.npmmirror.com/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz · https://registry.npmmirror.com/statuses/-/statuses-2.0.2.tgz · https://registry.npmmirror.com/toidentifier/-/toidentifier-1.0.1.tgz · https://registry.npmmirror.com/type-is/-/type-is-2.0.1.tgz · https://registry.npmmirror.com/typescript/-/typescript-6.0.2.tgz · https://registry.npmmirror.com/undici-types/-/undici-types-7.18.2.tgz · https://registry.npmmirror.com/unpipe/-/unpipe-1.0.0.tgz · https://registry.npmmirror.com/vary/-/vary-1.1.2.tgz · https://registry.npmmirror.com/which/-/which-2.0.2.tgz · https://registry.npmmirror.com/wrappy/-/wrappy-1.0.2.tgz · https://registry.npmmirror.com/zod/-/zod-4.3.6.tgz · https://registry.npmmirror.com/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz

references/company-faq.md Markdown · 125 lines

https://www.sxslqh.com/Introduction/26.html · https://www.sxslqh.com/，

references/api-auth.md Markdown · 199 lines

https://slzqapi.sxslqhsh.com/mobile-api/static/page/openclaw-agreement

Other files · paths-cloud-orders.yaml · openapi.yaml · cloud-orders.json · api-cloud-orders.md · paths-holding.yaml · api-orders.md

57 files · 557.9 KB · 11952 lines

Markdown 18f · 3121LYAML 10f · 2823LJSON 14f · 2739LTypeScript 2f · 1592LJavaScript 6f · 1403LShell 3f · 267LOther 2f · 6LText 1f · 1L

├─ ▾ 📁 assets

│ ├─ 📝 README.md Markdown 47L · 2.8 KB

│ ├─ 📄 kefu-qrcode.base64.txt Text 1L · 1.1 KB

│ └─ 📦 kefu-qrcode.png 1.5 KB

├─ ▾ 📁 install

│ ├─ 🔧 doctor.sh Shell 118L · 5.8 KB

│ ├─ 📜 generate_mcp_config.mjs JavaScript 42L · 1.5 KB

│ ├─ 📜 setup-clawhub.mjs JavaScript 128L · 4.1 KB

│ ├─ 🔧 test_connection.sh Shell 123L · 5.6 KB

│ ├─ 📜 test_mcp_tools.mjs JavaScript 40L · 1.4 KB

│ └─ 🔧 test_mcp_tools.sh Shell 26L · 891 B

├─ ▾ 📁 references

│ ├─ ▾ 📁 openapi

│ │ ├─ 📋 paths-account.yaml YAML 99L · 5.3 KB

│ │ ├─ 📋 paths-auth.yaml YAML 135L · 5.7 KB

│ │ ├─ 📋 paths-catalog.yaml YAML 263L · 9.5 KB

│ │ ├─ 📋 paths-cloud-orders.yaml YAML 578L · 28.6 KB

│ │ ├─ 📋 paths-holding.yaml YAML 366L · 11.1 KB

│ │ ├─ 📋 paths-market.yaml YAML 172L · 7.0 KB

│ │ ├─ 📋 paths-news.yaml YAML 90L · 3.4 KB

│ │ ├─ 📋 paths-positions-orders.yaml YAML 241L · 10.0 KB

│ │ └─ 📋 paths-skill.yaml YAML 105L · 4.1 KB

│ ├─ ▾ 📁 tools

│ │ ├─ ▾ 📁 parts

│ │ │ ├─ 📋 account.json JSON 57L · 4.1 KB

│ │ │ ├─ 📋 auth.json JSON 87L · 4.0 KB

│ │ │ ├─ 📋 catalog.json JSON 151L · 5.9 KB

│ │ │ ├─ 📋 cloud-orders.json JSON 532L · 22.0 KB

│ │ │ ├─ 📋 holding.json JSON 253L · 8.0 KB

│ │ │ ├─ 📋 market.json JSON 106L · 7.5 KB

│ │ │ ├─ 📋 news.json JSON 42L · 1.7 KB

│ │ │ ├─ 📋 positions-orders.json JSON 192L · 9.3 KB

│ │ │ └─ 📋 skill.json JSON 43L · 1.6 KB

│ │ └─ 📋 index.json JSON 15L · 458 B

│ ├─ 📝 api-account.md Markdown 174L · 6.6 KB

│ ├─ 📝 api-app-cn.md Markdown 40L · 1.5 KB

│ ├─ 📝 api-auth.md Markdown 199L · 10.2 KB

│ ├─ 📝 api-catalog.md Markdown 297L · 8.0 KB

│ ├─ 📝 api-cloud-orders.md Markdown 265L · 14.5 KB

│ ├─ 📝 api-examples-errors.md Markdown 152L · 7.9 KB

│ ├─ 📝 api-holding.md Markdown 137L · 5.6 KB

│ ├─ 📝 api-market.md Markdown 209L · 7.3 KB

│ ├─ 📝 api-news.md Markdown 86L · 4.0 KB

│ ├─ 📝 api-orders.md Markdown 279L · 10.1 KB

│ ├─ 📝 api-positions.md Markdown 88L · 3.5 KB

│ ├─ 📝 api-skill.md Markdown 92L · 2.7 KB

│ ├─ 📝 api.md Markdown 139L · 7.8 KB

│ ├─ 📝 company-faq.md Markdown 125L · 10.4 KB

│ ├─ 📋 openapi.yaml YAML 774L · 27.3 KB

│ └─ 📝 usage-notes.md Markdown 505L · 47.3 KB

├─ ▾ 📁 runtime

│ └─ ▾ 📁 mcp

│ ├─ ▾ 📁 dist

│ │ ├─ 📜 index.d.ts TypeScript 2L · 33 B

│ │ └─ 📜 index.js JavaScript 1129L · 74.2 KB

│ ├─ ▾ 📁 scripts

│ │ ├─ 📜 test-mcp-tools.mjs JavaScript 53L · 2.0 KB

│ │ └─ 📜 verify-http.mjs JavaScript 11L · 423 B

│ ├─ ▾ 📁 src

│ │ └─ 📜 index.ts TypeScript 1590L · 76.1 KB

│ ├─ 📝 README.md Markdown 148L · 6.2 KB

│ ├─ 📋 package-lock.json JSON 1178L · 42.1 KB

│ ├─ 📋 package.json JSON 34L · 897 B

│ └─ 📋 tsconfig.json JSON 15L · 328 B

├─ 📄 .clawhubignore 5L · 49 B

├─ 📝 SKILL.md Markdown 139L · 5.9 KB

├─ 📄 VERSION 1L · 7 B

└─ 📋 manifest.json JSON 34L · 848 B

Security positives

所有网络请求仅指向单一已知域名 https://slzqapi.sxslqhsh.com，无动态域名解析或IP直连

API密钥通过maskApiKey函数在日志和响应中自动脱敏，前7后4字符可见

原子写（atomic write）保护凭证文件，中途失败不污染原文件

凭证文件权限0600，仅当前用户可读写

安装脚本使用npm ci依赖package-lock.json锁定版本，防止依赖劫持

无base64/eval/动态代码执行，无混淆特征

无凭证遍历收割、无敏感路径访问（~/.ssh、.env等）

无反向shell、C2通信或数据外泄

实盘操作需要用户逐笔明确确认，多次安全提示到位

代码质量高，大量防御性编程（输入校验、边界处理、错误恢复）