ifind-data
What this skill does
Financial data query using the iFinD API
github/leoyeai - Hardcoded Secrets - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=ifind-dataAssessments (4)
Hardcoded Secrets
Hardcoded Secrets via local-llm-review
scripts/ifind-api.sh
The script contains a hardcoded API secret: 'IFIND_API_SECRET="ps_123c80aaf4c7134ee9faebd4d0cb0783a42be1ce9e440fbc"'Hardcoded Secrets via local-llm-review
scripts/ifind-api/main.go
The Go code contains a hardcoded API secret: 'ifindAPISecret = "ps_123c80aaf4c7134ee9faebd4d0cb0783a42be1ce9e440fbc"'Data Exfiltration
Data Exfiltration via local-llm-review
scripts/ifind-api.sh
The script sends data to 'https://ifind.skillapp.vip' with the header 'X-Api-Secret: ${IFIND_API_SECRET}' which is a potential data exfiltration point.Insecure Logging
Insecure Logging via local-llm-review
scripts/ifind-api/main.go
The Go code logs endpoint, status, error message, and other potentially sensitive information to a file without any filtering or obfuscation.Badge
Add the Anomity scan badge for ifind-data to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of ifind-data? Report an issue or request a rescan.
