ClawHub
Back to skill

Security audit

Fund Manager

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is mostly coherent, but it packages real portfolio details and directs agents to read a hard-coded persistent memory file and write reports automatically.

Install only if you are comfortable with a finance assistant that uses broad read/write/command and web tools. Before use, remove real portfolio data from the package, replace the hard-coded MEMORY.md path with a user-selected portfolio file, require confirmation before reading or writing local files, and treat all trading suggestions as informational rather than licensed financial advice.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:269
Finding

Unrestricted Access to an External Persistent Agent Memory File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 269-275
Vulnerability Type: Hard-coded access to persistent Agent state outside the Skill workspace
Risk Level: Medium

Vulnerable Code Snippet

The following is an English rendering of the complete affected instruction block:

markdown
### Daily routine (09:35 automated task V2)
1. Read `c:\Users\a\WorkBuddy\20260406104955\.workbuddy\memory\MEMORY.md` to obtain the portfolio snapshot.
2. Query the latest estimated and official net asset values of eight funds.
3. Calculate daily return, cumulative return, and total asset changes.
4. Scan broad-market conditions, including the Shanghai Composite, ChiNext, trading volume, and northbound capital.
5. Check whether significant news or policy changes affect the holdings.
6. Generate and save a standardized report as `Daily_Monitoring_YYYYMMDD.md`.

Technical Analysis

The Skill instructs the Agent to read a hard-coded persistent memory file located outside the project directory. Persistent Agent memory may contain unrelated conversation history, private user information, credentials, operational instructions, or state belonging to another workspace.

This violates least-privilege principles because portfolio analysis does not inherently require unrestricted access to global or cross-session Agent memory. The broad Read, Write, and Bash permissions declared at SKILL.md:7 increase the likelihood that the instruction can be carried out in an environment that does not enforce workspace isolation.

No instruction to transmit the memory contents to an external destination was identified. The confirmed issue is unauthorized or unnecessarily broad local data access, not confirmed exfiltration.

Attack Path

  1. A user or automated process activates the Skill.
  2. The daily routine is invoked.
  3. The Agent follows the hard-coded instruction and opens the external MEMORY.md file.
  4. Info ...[truncated 766 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the hard-coded absolute path to persistent Agent memory.
  2. Require the user to select or provide a portfolio file explicitly for each workspace.
  3. Restrict file reads and writes to a dedicated Skill-owned directory.
  4. Request explicit user confirmation before accessing any persistent memory or file outside the project workspace.
  5. Validate the resolved file path against an allowlisted base directory and reject path traversal or symbolic-link escapes.
  6. Remove Bash permission unless a documented feature requires command execution.
  7. Separate portfolio state from general Agent memory and store only the minimum fields required for analysis.
  8. Prevent generated reports from including unrelated memory content through strict field-level parsing and output filtering.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:28
Finding

Personal Financial Portfolio Data Embedded in a Distributable Skill File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-55
Vulnerability Type: Plaintext storage of user-specific financial information
Risk Level: Medium

Vulnerable Code Snippet

The following is an English rendering of the affected source segment:

markdown
### User profile
- Total assets: approximately CNY 5,000
  (CNY 2,778 in funds and approximately CNY 2,200 withdrawn as cash)
- Investment preference: technology growth, including AI, robotics, and ChiNext
- Risk tolerance: medium to high, but sensitive to losses
- Primary objective: maximize returns by buying low and selling high

## Current portfolio snapshot, confirmed on 2026-04-17

| Number | Holding | Code | Amount | Holding return | Return rate |
| 1 | Cathay ChiNext Artificial Intelligence ETF Feeder C | 025493 | CNY 980 | +CNY 222 | +29.3% |
| 2 | ChinaAMC Artificial Intelligence ETF Feeder C | 008586 | CNY 625 | +CNY 33 | +5.6% |
| 3 | Cathay Gold Industry Equity A | 021674 | CNY 360 | +CNY 117 | +47.9% |
| 4 | ChinaAMC Semiconductor Chip ETF Feeder C | 008888 | CNY 217 | +CNY 18 | +9.2% |
| 5 | Tianhong Robotics ETF Feeder C | 014881 | CNY 290 | -CNY 1.6 | -0.5% |
| 6 | Yongying General Aviation Industry ETF Feeder C | 016877 | CNY 104 | +CNY 3.6 | +3.6% |
| 7 | Yinhua Innovative Pharmaceutical Industry ETF Feeder C | 012782 | CNY 102 | +CNY 2.3 | +2.3% |
| 8 | Bank of China STAR Market and ChiNext AI Index C | Not listed | CNY 100 | CNY 0 | 0% |

Total fund assets: approximately CNY 2,778
Total holding return: CNY 542, or 24.2%

Technical Analysis

The primary Skill definition contains a specific user’s asset balance, risk profile, individual fund positions, invested amounts, gains, losses, and historical transaction information. package.json identifies this file as the package’s main distributable artifact and includes SKILL.md in the published file list.

Consequently, the data is not isolated as runti ...[truncated 1559 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all real user balances, holdings, returns, transaction history, and behavioral profile data from the distributable Skill definition.
  2. Replace real values with clearly labeled synthetic examples or template placeholders.
  3. Store runtime portfolio information in a user-controlled data file excluded from package publication and source control.
  4. Apply restrictive file permissions and encryption at rest when persistent storage is necessary.
  5. Add relevant portfolio and memory files to .gitignore and package exclusion rules.
  6. Scan repository history, release artifacts, package registries, mirrors, and backups for previously published financial data.
  7. Rotate or purge affected artifacts where feasible; rewriting only the current file is insufficient if earlier revisions remain accessible.
  8. Minimize retained data and separate reusable investment methodology from user-specific financial state.
  9. Add an automated secret and privacy-data scan to the release process to prevent future publication of personal financial records.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill is defined entirely around Chinese-language identity and output behavior, and later sections prescribe A-share-specific Chinese presentation conventions. There is no indication that the user can choose another language or locale, which violates the requirement to avoid forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill authorizes broad Bash/script execution and references multiple external scripts and toolchains, some beyond narrowly scoped fund-management tasks. Even if intended for financial analysis, this expands the attack surface by allowing arbitrary local command execution and indirect execution of unreviewed helper scripts, which could access local data or perform unintended actions if the skill is triggered in the wrong context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The daily workflow instructs the agent to read a hardcoded user-specific memory file path as a routine step, despite that path not being established as an explicit user-provided input for the current task. This creates a confidentiality risk because the skill normalizes access to stored local data and could expose or process sensitive portfolio or personal information without fresh consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes automatic reading of stored portfolio data and automatic writing of daily reports, but does not warn the user that local files will be accessed and modified. This is dangerous because silent data access and persistence can surprise users, overwrite files, or create privacy issues, especially in an environment with broad Read/Write permissions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly directs routine reading and persistence of user portfolio data from a memory file, which is sensitive financial information. In the context of a finance skill, this makes the issue more serious because the data is likely personally identifiable or economically sensitive, and the workflow treats continued storage and reuse as implicit rather than consent-driven.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may opt into another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document gives concrete allocation targets, buy/sell thresholds, and fund-specific recommendations without any visible risk disclosure, suitability caveat, or statement that the guidance is general educational content rather than personalized financial advice. In a skill explicitly positioned as a private fund manager for a real ~5,000 RMB portfolio, users may reasonably treat these instructions as actionable investment advice and incur losses from unsuitable or overly concentrated trades.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section gives explicit market-timing and asset-allocation conclusions such as identifying a current macro phase and stating that stocks are superior, but it provides no warning that such content is educational only, uncertain, and not personalized financial advice. In the context of a fund-management skill, users may treat these statements as actionable investment recommendations and make unsuitable or risky trades based on oversimplified macro interpretations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document gives explicit buy/sell timing guidance, labels some setups as 'strongest signals,' and presents a step-by-step decision framework without any warning about financial risk, uncertainty, or that the material is educational rather than personalized investment advice. In the context of a fund-management skill that monitors holdings and suggests rebalancing, this increases the chance that users will treat heuristic technical-analysis content as authoritative instructions and make harmful financial decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill as a Chinese-language assistant, but there is no indication that users can select another language or opt in to this locale. Under the policy rules, a skill that appears to enforce a specific language without choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file is entirely written in Chinese and provides no indication that users may choose another language or locale. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The entire skill file is presented only in Chinese and does not indicate that language choice is optional or region-specific. Per the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The file content is entirely Chinese, which may effectively force a specific language for users unless the skill explicitly offers language choice or documents a justified region-specific constraint.

Content

No source excerpt is available for this finding.