中文 EN
开始可信审查
安全决策报告

StockToday

Stock data API skill with undocumented backup server IPs and shell execution for version checks, but no malicious behavior detected — all hidden functionality has legitimate, verifiable purposes.

安装决策优先 来源: ClawHub 扫描时间: 2026/6/24
文件 19
IOC 13
越权项 2
发现 4

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 2 项声明之外的能力或越权行为。

阻止
隐藏执行与外联

提取到 3 个高危 IOC 或外联信号。

通过
攻击链与高危发现

没有形成明确的恶意路径。

复核
依赖与供应链卫生

发现 2 项需要关注的依赖或供应链线索。

风险分是怎么被拉高的

Undocumented backup server IPs +10

SKILL.md only mentions tushare.citydata.club but code also contacts 111.229.164.2:8083, 124.223.112.152:6331, 110.42.211.9:9900 as backup gateways — no doc declaration

Undocumented shell execution +5

execFile('npx clawhub info stocktoday-skill') called on startup for version checking — not declared in SKILL.md filesystem/shell capabilities

Unpinned dependencies +5

axios: ^1.6.0, @modelcontextprotocol/sdk: ^1.0.0 allow minor version updates with potential supply chain risk

最关键的证据

中危 文档欺骗

Undocumented backup server IPs

SKILL.md only declares tushare.citydata.club as the backend, but src/index.ts lines 63-65 hardcode 3 additional backup server IPs (111.229.164.2:8083, 124.223.112.152:6331, 110.42.211.9:9900) as failover endpoints. INSTALL.md documents them but SKILL.md does not. The IPs belong to Alibaba Cloud (AS24400) and are not CDN/proxy addresses.

src/index.ts:63
Add backup server IPs to SKILL.md capabilities section under '后端' or as a footnote. Consider using DNS hostnames instead of raw IPs.
中危 文档欺骗

Undeclared shell execution

src/index.ts executes 'npx clawhub info stocktoday-skill' via execFile to check for newer versions. This is shell:READ capability not declared anywhere in SKILL.md. Executed on startup with 12s timeout and repeated every 24h.

src/index.ts:85
Declare shell:READ in SKILL.md capability section. Alternatively use HTTPS fetch instead of execFile for version checking.
低危 供应链

Dependencies not version-pinned

package.json uses caret ranges: axios@^1.6.0, @modelcontextprotocol/sdk@^1.0.0, typescript@^5.9.3. This allows automatic minor/patch updates that could introduce vulnerabilities without user awareness.

package.json:13
Pin to exact versions: [email protected], @modelcontextprotocol/[email protected]. Review axios for known CVEs (CVE-2024-39338, CVE-2024-38702).
低危 文档欺骗

Undeclared token file persistence

Token info is persisted to ~/.stocktoday-skill/token-cache.json (hashed with sha256[:16], plaintext token stripped before write). This filesystem:WRITE activity is not declared in SKILL.md. However, the design is privacy-preserving (no plaintext token stored).

src/index.ts:29
Document token caching behavior in SKILL.md configuration section.

声明能力 vs 实际能力

文件系统 阻止
声明 NONE
→
推断 READ+WRITE
src/index.ts:29 — writes ~/.stocktoday-skill/token-cache.json
网络访问 通过
声明 READ
→
推断 WRITE
src/index.ts:63-65 — POSTs to tushare backend (legitimate API calls)
命令执行 阻止
声明 NONE
→
推断 READ
src/index.ts:85-87 — execFile npx clawhub for version check
环境变量 通过
声明 NONE
→
推断 READ
src/index.ts:15-19 — reads STOCKTODAY_TOKEN, STOCKTODAY_URL etc (legitimate, documented config)

可疑产物与外联

高危 IP 地址
111.229.164.2

INSTALL.md:233

高危 IP 地址
124.223.112.152

INSTALL.md:234

高危 IP 地址
110.42.211.9

INSTALL.md:235

中危 外部 URL
https://nodejs.org

INSTALL.md:10

中危 外部 URL
https://stocktoday.cn

INSTALL.md:12

中危 外部 URL
https://tushare.citydata.club/

INSTALL.md:222

中危 外部 URL
http://111.229.164.2:8083/

INSTALL.md:233

中危 外部 URL
http://124.223.112.152:6331/

INSTALL.md:234

中危 外部 URL
http://110.42.211.9:9900/

INSTALL.md:235

中危 外部 URL
https://opencollective.com/express

package-lock.json:243

中危 外部 URL
https://opencollective.com/fastify

package-lock.json:617

中危 外部 URL
https://clawhub.ai/user/usa2046

skill-card.md:7

依赖与供应链

包名版本来源漏洞备注
axios ^1.6.0 npm 否 Caret range allows minor updates — pin to exact version
@modelcontextprotocol/sdk ^1.0.0 npm 否 Caret range — pin to exact version
typescript ^5.9.3 npm 否 Dev dependency, used only at build time
terser ^5.48.0 npm 否 Dev dependency, minifier

文件构成

19 个文件 · 8859 行
TypeScript 5 个文件 · 2945 行JavaScript 5 个文件 · 2880 行JSON 4 个文件 · 1538 行Markdown 5 个文件 · 1496 行
需关注文件 · 4
dist/token_breaker.js JavaScript · 108 行
src/token_breaker.ts TypeScript · 124 行
src/index.ts TypeScript · 989 行
Undocumented backup server IPs · Undeclared shell execution · Undeclared token file persistence
package-lock.json JSON · 1483 行
https://opencollective.com/express · https://opencollective.com/fastify
其他文件 · tool_schemas.js · tool_schemas.ts · index.js · SKILL.md · RELEASE_NOTES.md · rate_limit.js +2

安全亮点

No credential harvesting — token is hashed before any persistence, plaintext stripped from cached responses
No base64-encoded payloads, eval(), or obfuscated code execution
No access to sensitive paths (~/.ssh, ~/.aws, .env)
No data exfiltration — all network calls are legitimate tushare stock API requests
No reverse shell, C2 communication, or suspicious outbound connections beyond declared backend
Token circuit breaker prevents IP ban, a user-protective feature
Rate limiter with transparent config (60/min, 5 concurrent) is well-implemented and documented in code