mx_finance_search Security Report — Trusted | ClawSafe

5 /100

mx_finance_search

基于东方财富数据库的金融资讯搜索工具，支持自然语言查询新闻、公告、研报等

Legitimate financial news search skill that queries East Money API with proper credential handling and no malicious indicators.

Skill Namemx_finance_search

Duration27.5s

Enginepi

✓

Safe to install

Skill is safe to use. Ensure EM_API_KEY is obtained from the official East Money portal.

Resource	Declared	Inferred	Status	Evidence
Network	`READ`	`READ`	✓ Aligned	scripts/get_data.py:73 - POST to https://ai-saas.eastmoney.com
Filesystem	`WRITE`	`WRITE`	✓ Aligned	scripts/get_data.py:165 - output_path.write_text(content)
Environment	`READ`	`READ`	✓ Aligned	scripts/get_data.py:52 - os.environ.get('EM_API_KEY')
Shell	`NONE`	`NONE`	—	No subprocess/shell execution detected

1 High 3 findings

🔑

High API Key 疑似硬编码凭证

API_KEY="your_api_key_here"

SKILL.md:61

🔗

Medium External URL 外部 URL

https://ai.eastmoney.com/mxClaw

SKILL.md:25

🔗

Medium External URL 外部 URL

https://ai-saas.eastmoney.com/proxy/b/mcp/tool/searchNews

scripts/get_data.py:73

File Tree

2 files · 16.7 KB · 456 lines

Python 1f · 298L Markdown 1f · 158L

├─ ▾ 📁 scripts

│ └─ 🐍 get_data.py Python 298L · 11.8 KB

└─ 📝 SKILL.md Markdown 158L · 5.0 KB

✓ Only accesses EM_API_KEY environment variable for authentication

✓ No credential harvesting or exfiltration

✓ No shell command execution

✓ No sensitive path access (~/.ssh, ~/.aws, .env)

✓ No base64/eval obfuscation patterns

✓ No remote script execution (curl|bash, wget|sh)

✓ Uses standard urllib library for HTTP requests

✓ Generates unique user IDs per request (privacy-preserving)

✓ Clear error handling without information leakage

✓ Code and documentation are consistent