ClawHub
Back to skill

Security audit

FireAnt Stock Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Vietnamese stock lookup helper that uses browser automation for Google and FireAnt, with no evidence of deception, exfiltration, persistence, or destructive behavior.

Install this only if you are comfortable with the agent running a local Python script that opens an OpenClaw-controlled browser and visits Google and FireAnt for Vietnamese stock data. Treat results as scraped market information that may be incomplete or stale, and use explicit Vietnamese symbols or indices to avoid accidental invocation for unrelated market questions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill description materially overstates and misrepresents behavior: it claims broad stock/index support and rich financial metrics, while the workflow relies on undisclosed Google search and browser automation and may not support indices as claimed. This is dangerous because hidden browsing/search behavior can expand the attack surface, surprise users and orchestrators, and cause unsafe or unintended execution paths under false assumptions about what the skill does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises executable behavior involving network access and shell/script execution but does not declare any tool scope or permissions boundaries. This is dangerous because it prevents least-privilege enforcement and makes it harder for a host agent or reviewer to understand and constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file description explicitly states the tool is for Vietnamese stock lookup, and later logic relies on Vietnamese text and a Vietnam-specific website. This imposes a fixed language/locale behavior without user opt-in or an explicit language-selection mechanism, which matches the policy-violation category for forced language or locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill can drive a host-side browser automation CLI, which is a materially broader capability than simply fetching stock data from FireAnt. In an agent setting, browser automation on the host can access arbitrary web content and potentially authenticated browser context, so the mismatch between declared purpose and actual capability expands the attack surface and makes misuse more dangerous.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_stock.py (reported line 17)May include surrounding context.

python
def run_openclaw_command(command: List[str]) -> Dict:
    """Execute OpenClaw browser command and return result"""
    try:
        result = subprocess.run(['openclaw'] + command, 
                              capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            return {"error": f"Command failed: {result.stderr}"}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The query string uses Vietnamese words regardless of user preference or environment. Because the skill does not offer a language choice or require explicit opt-in to Vietnamese, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest description limits the skill to Vietnamese stocks and indices and uses locale-specific market terminology, but it does not explicitly state that this is a Vietnam-specific tool or prompt the user to confirm that scope. In environments with language or locale choice requirements, this can be a policy concern if the user expects broader or configurable market coverage.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The example "How is the market doing today?" is common everyday phrasing and the document maps it directly to VNINDEX without clarifying boundaries or exclusions. This makes the skill's trigger scope ambiguous and could cause unintended invocation for general market commentary requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The implementation performs a Google search and general navigation instead of directly querying the stated FireAnt source. That exposes the workflow to search-result manipulation, redirects, and unintended page interaction, which is riskier in a browser-automation context than a direct navigation or API call.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.