ClawHub
Back to skill

Security audit

Trading Signals

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its trading-signal purpose, but it can send reports to a hard-coded Gmail address using Resend credentials read from the user's home directory.

Review before installing. Do not run the scripts with existing Resend credentials unless you have changed references/assets.json to your own intended recipient or disabled alerts. Treat the default email address as an external destination, and expect market symbols, prices, indicators, and generated signals to leave your machine if alerts send successfully.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/assets.json:17
Finding

Ambient Resend Credentials Used to Send Reports to a Hard-Coded External Recipient

Content
View full analysis
{ const req = https.request({ hostname: 'api.resend.com', path: '/emails', method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) } }, (res) => { ``` The analysis entry point automatically uses the configured address when qualifying signals exist or `--always-send` is supplied: ```javascript if (config.alerts?.email) { if (newSignals.length > 0 || alwaysSend) { try { const subject = newSignals.length > 0 ? `🚨 Neue Trading Signale - ${new Date().toLocaleDateString('de-DE')}` : `📈 Trading Signale - ${new Date().toLocaleDateString('de-DE')}`; ...[truncated 2813 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/lib/email.js:77
Finding

Unescaped Dynamic Values in Generated HTML Email

Content
View full analysis
0) { html += ''; // Sort by strength: strong first const strengthOrder = { strong: 0, medium: 1, weak: 2 }; allSignals.sort((a, b) => strengthOrder[a.strength] - strengthOrder[b.strength]); for (const signal of allSignals) { const typeClass = signal.type === 'BUY' ? 'buy' : 'sell'; const strengthClass = signal.strength; html += ``; } html += '
AssetTypGrundStärke
${signal.asset}${signal.type}${signal.reason}${signal.strength}
'; } ``` Detailed result fields are likewise concatenated without escaping: ```javascript // Detailed analysis html += '

📉 Detaillierte Analyse

'; for (const result of results) { html += `

${result.name} (${result.symbol})

`; html += `

Preis: ${result.price?.toFixed(2) || 'n/a'} (${result.change?.toFixed(2) || 0}%)

`; html += `

RSI: ${result.rsi?.toFixed(1) || 'n/a'} | SMA20: ${result.sma20?.toFixed(2) || 'n/a'} | SMA50: ${result.sma50?.toFixed(2) || 'n/a'}

`; if (result.signals.length > 0) { html += '
    '; for (const signal of result.signals) { const emoji = signal.type === 'BUY' ? '🟢' : '🔴'; html += `
  • ${emoji} ${signal.type} - ${signal.reason} (${signal.strength})
    • `; } html += '
'; } else { html += '

✅ Keine klaren Signale

'; } } ``` ### Technical Analysis The formatter builds an HTML document through string interpolation but does not encode HTML metacharacters in dynamic fields. Relevant values include as ...[truncated 1777 chars]
Remediation
View remediation
`, `"`, `'`, `&`, links, images, and malformed tags to verify that output remains text. 7. Consider also generating a plain-text email alternative to reduce dependence on HTML rendering. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose focuses on market analysis, but the implementation reportedly also sends outbound email, reads local credentials, and uses an external email service that are not clearly disclosed. Hidden side effects like credential access and third-party communications are dangerous because users may invoke the skill for analysis without realizing it can exfiltrate data or trigger external actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose focuses on market analysis, but the implementation reportedly also sends outbound email, reads local credentials, and uses an external email service that are not clearly disclosed. Hidden side effects like credential access and third-party communications are dangerous because users may invoke the skill for analysis without realizing it can exfiltrate data or trigger external actions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
node scripts/analyze.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
node scripts/analyze.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
node scripts/analyze.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
node scripts/monitor.js --interval 15

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
node scripts/monitor.js --interval 15

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

Accessing a credential file under the user's home directory is a clear credential-access behavior. In this skill context, where local secret retrieval is not necessary to generate trading signals, this is especially dangerous because it enables unauthorized use of stored secrets to communicate with an external service.

Content

Scanner excerpt · scripts/lib/email.js (reported line 5)May include surrounding context.

js
const fs = require('fs');

function sendEmail(to, subject, htmlBody) {
  const credentialsPath = process.env.HOME + '/.config/resend/credentials.json';
  
  if (!fs.existsSync(credentialsPath)) {
    return Promise.reject(new Error('Resend credentials not found'));

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises executable scripts and detected environment access but does not declare any explicit tool scope or permissions boundary. In practice, this makes it harder to reason about what the skill may access at runtime and increases the chance of unintended secret, filesystem, or network use through inherited defaults.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is broad enough to match many normal finance-related requests, increasing the chance the skill is invoked when the user did not intend automated analysis or related side effects. In this context, unintended invocation is more dangerous because the skill also advertises monitoring and alerts, which may lead to network access or notifications without clear user expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill mentions email notifications for strong signals, but the description does not prominently warn users that invocation may result in outbound communications. Undisclosed notification behavior is risky because it can surprise users, contact third parties, and potentially leak sensitive trading interests or account-linked information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persists signal history to a local state file and later uses that state to drive behavior, which goes beyond one-shot signal generation. Combined with its email capability elsewhere in the file, this creates monitoring/notification functionality not clearly reflected by the described role, increasing privacy and transparency risk because users may not expect persistent storage or automated follow-up actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code formats timestamps with the fixed locale 'de-DE' and the script’s console and email text is written in German, which imposes a specific language/locale on users. The policy allows locale constraints only when they are opt-in or clearly justified, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code can proactively send emails when new signals are detected, which is materially different from merely generating trading signals on demand. Undisclosed outbound communications are risky because they can surprise users, create data egress paths, and enable persistent monitoring behavior that exceeds the apparent scope of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file adds outbound email capability to a skill whose declared purpose is generating trading signals, creating an unnecessary exfiltration/output channel. Even if intended for reporting, the capability increases risk because it can transmit generated content and recipient data to an external service unrelated to core signal computation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code reads API credentials from the user's home directory and uses them to authenticate to an external email provider, which is sensitive credential access not justified by the stated trading-signal purpose. In the context of an analysis skill, accessing local secrets materially raises the risk of unauthorized external communication and abuse of user-owned accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The function sends email content and recipient information to a third-party API without any evidence in this file of a user-facing warning, consent flow, or confirmation step. That creates a quiet data-transfer path that could send trading analysis, asset names, or other potentially sensitive user-requested content off-platform without the user's awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function forces date formatting to the 'de-DE' locale, and the generated email content includes German labels and text, without any indication that the user opted into German or that the skill is intentionally region-specific. This imposes a specific language/locale choice in natural-language output, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script's console messages and date/time formatting are hard-coded in German, including explicit locale settings like 'de-DE' and German user-facing strings. This is a natural-language policy concern because the skill enforces a specific language/locale without user opt-in or any documented region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The quick-start instructions include continuous monitoring at 15-minute intervals, but the skill description does not clearly warn that it may run persistently. Persistent automation increases operational and privacy risk because it can generate ongoing network traffic, repeated notifications, and unanticipated resource consumption after a single invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This JSON file contains natural-language labels such as "Silber", "Öl (WTI)", and "Platin" alongside English labels, which imposes a mixed locale presentation without any visible user opt-in or documented regional scope. The stated policy for this review flags language or locale constraints when they are not clearly offered as a choice or justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code emits natural-language trading reasons such as 'überverkauft' and 'Preis nahe SMA20' while other strings remain in English, effectively imposing a specific locale in user-visible output. The file provides no mechanism for selecting language or documenting that the skill is intentionally German-language only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code file performs an external data request by connecting to TradingView and calling chart.setMarket(symbol, { timeframe, range }), but the file contains no confirmation prompt, logging, comment, or docstring disclosing that network activity will occur. Because SQP-2 applies to code files for network/HTTP-style transmission or retrieval actions lacking any user disclosure, this is a qualifying missing-warning issue.

Content

No source excerpt is available for this finding.