ClawHub
Back to skill

Security audit

IBKR + OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it asks users to set up persistent live brokerage access with plaintext credentials while presenting the workflow as broadly read-only safe.

Review carefully before installing. Prefer a paper IBKR account, avoid live mode unless necessary, do not store your main brokerage password in a shared or backed-up workspace, restrict .env permissions, keep VNC disabled unless needed, and install Docker and the IB Gateway container only from reviewed or pinned sources.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill’s description materially understates risky behavior and overstates implemented capabilities. It instructs users to clone and run a third-party IB Gateway Docker setup and store brokerage credentials in plaintext, while advertising the workflow as 'read-only safe'; this can mislead users into exposing real financial credentials and enabling a live broker connection under a false sense of safety.

Session Persistence

Medium
Category
Rogue Agent
Content
### Step 3: Configure Environment

Create a `.env` file in the `ib-gateway-docker` directory:

```env
# IBKR Account
Confidence
98% confidence
Finding
The skill instructs users to place IBKR username and password in a local .env file in plaintext, creating a persistent secret exposure risk. Brokerage credentials are highly sensitive, and storing them unencrypted on disk increases the chance of compromise through local malware, backups, repo leakage, accidental sharing, or other skills/processes reading the workspace.

External Script Fetching

Low
Category
Supply Chain
Content
### Step 1: Install Docker

```bash
curl -fsSL https://get.docker.com | sh
docker --version
docker compose version
```
Confidence
92% confidence
Finding
Piping a remote script directly from the network into a shell executes unpinned code without inspection or integrity verification. If the remote endpoint, transport chain, or hosting account is compromised, users may run attacker-controlled installation commands on their system.

Chaining Abuse

High
Category
Tool Misuse
Content
### Step 1: Install Docker

```bash
curl -fsSL https://get.docker.com | sh
docker --version
docker compose version
```
Confidence
95% confidence
Finding
The explicit use of '| sh' creates a command-execution chain where untrusted remote content is immediately executed by the shell. In a skill that already asks users to configure financial infrastructure and credentials, this sharply increases risk because a compromised install script could establish persistence, steal secrets, or alter the host before the user notices.

Static analysis

No suspicious patterns detected.