Skill Trust Decision
StockToday
Stock data API skill with undocumented backup server IPs and shell execution for version checks, but no malicious behavior detected — all hidden functionality has legitimate, verifiable purposes.
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Block
Hidden execution and egress
3 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
2 dependency or supply-chain issues need attention.
What drove the risk score up
Undocumented backup server IPs +10
SKILL.md only mentions tushare.citydata.club but code also contacts 111.229.164.2:8083, 124.223.112.152:6331, 110.42.211.9:9900 as backup gateways — no doc declaration
Undocumented shell execution +5
execFile('npx clawhub info stocktoday-skill') called on startup for version checking — not declared in SKILL.md filesystem/shell capabilities
Unpinned dependencies +5
axios: ^1.6.0, @modelcontextprotocol/sdk: ^1.0.0 allow minor version updates with potential supply chain risk
Most important evidence
Medium Doc Mismatch
Undocumented backup server IPs
SKILL.md only declares tushare.citydata.club as the backend, but src/index.ts lines 63-65 hardcode 3 additional backup server IPs (111.229.164.2:8083, 124.223.112.152:6331, 110.42.211.9:9900) as failover endpoints. INSTALL.md documents them but SKILL.md does not. The IPs belong to Alibaba Cloud (AS24400) and are not CDN/proxy addresses.
src/index.ts:63 Add backup server IPs to SKILL.md capabilities section under '后端' or as a footnote. Consider using DNS hostnames instead of raw IPs.
Medium Doc Mismatch
Undeclared shell execution
src/index.ts executes 'npx clawhub info stocktoday-skill' via execFile to check for newer versions. This is shell:READ capability not declared anywhere in SKILL.md. Executed on startup with 12s timeout and repeated every 24h.
src/index.ts:85 Declare shell:READ in SKILL.md capability section. Alternatively use HTTPS fetch instead of execFile for version checking.
Low Supply Chain
Dependencies not version-pinned
package.json uses caret ranges: axios@^1.6.0, @modelcontextprotocol/sdk@^1.0.0, typescript@^5.9.3. This allows automatic minor/patch updates that could introduce vulnerabilities without user awareness.
package.json:13 Pin to exact versions: [email protected], @modelcontextprotocol/[email protected]. Review axios for known CVEs (CVE-2024-39338, CVE-2024-38702).
Low Doc Mismatch
Undeclared token file persistence
Token info is persisted to ~/.stocktoday-skill/token-cache.json (hashed with sha256[:16], plaintext token stripped before write). This filesystem:WRITE activity is not declared in SKILL.md. However, the design is privacy-preserving (no plaintext token stored).
src/index.ts:29 Document token caching behavior in SKILL.md configuration section.
Declared capability vs actual capability
Filesystem Block
Declared NONE
→ Inferred READ+WRITE
src/index.ts:29 — writes ~/.stocktoday-skill/token-cache.json Network Pass
Declared READ
→ Inferred WRITE
src/index.ts:63-65 — POSTs to tushare backend (legitimate API calls) Shell Block
Declared NONE
→ Inferred READ
src/index.ts:85-87 — execFile npx clawhub for version check Environment Pass
Declared NONE
→ Inferred READ
src/index.ts:15-19 — reads STOCKTODAY_TOKEN, STOCKTODAY_URL etc (legitimate, documented config) Suspicious artifacts and egress
High IP Address
111.229.164.2 INSTALL.md:233
High IP Address
124.223.112.152 INSTALL.md:234
High IP Address
110.42.211.9 INSTALL.md:235
Medium External URL
https://nodejs.org INSTALL.md:10
Medium External URL
https://stocktoday.cn INSTALL.md:12
Medium External URL
https://tushare.citydata.club/ INSTALL.md:222
Medium External URL
http://111.229.164.2:8083/ INSTALL.md:233
Medium External URL
http://124.223.112.152:6331/ INSTALL.md:234
Medium External URL
http://110.42.211.9:9900/ INSTALL.md:235
Medium External URL
https://opencollective.com/express package-lock.json:243
Medium External URL
https://opencollective.com/fastify package-lock.json:617
Medium External URL
https://clawhub.ai/user/usa2046 skill-card.md:7
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| axios | ^1.6.0 | npm | No | Caret range allows minor updates — pin to exact version |
| @modelcontextprotocol/sdk | ^1.0.0 | npm | No | Caret range — pin to exact version |
| typescript | ^5.9.3 | npm | No | Dev dependency, used only at build time |
| terser | ^5.48.0 | npm | No | Dev dependency, minifier |
File composition
19 files · 8859 lines
TypeScript 5 files · 2945 linesJavaScript 5 files · 2880 linesJSON 4 files · 1538 linesMarkdown 5 files · 1496 lines
Files of concern · 4
dist/token_breaker.js src/token_breaker.ts src/index.ts Undocumented backup server IPs · Undeclared shell execution · Undeclared token file persistence
package-lock.json https://opencollective.com/express · https://opencollective.com/fastify
Other files · tool_schemas.js · tool_schemas.ts · index.js · SKILL.md · RELEASE_NOTES.md · rate_limit.js +2
Security positives
No credential harvesting — token is hashed before any persistence, plaintext stripped from cached responses
No base64-encoded payloads, eval(), or obfuscated code execution
No access to sensitive paths (~/.ssh, ~/.aws, .env)
No data exfiltration — all network calls are legitimate tushare stock API requests
No reverse shell, C2 communication, or suspicious outbound connections beyond declared backend
Token circuit breaker prevents IP ban, a user-protective feature
Rate limiter with transparent config (60/min, 5 concurrent) is well-implemented and documented in code