open-market-data

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 0.1.0

Overview

This skill is a straightforward financial-data CLI helper, with a supply-chain caveat because it installs an unpinned npm package.

Install only if you are comfortable relying on the open-market-data npm package. Prefer a pinned or reviewed package version for sensitive environments, and avoid configuring financial-data API keys unless you trust how the CLI stores and uses them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-14
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml

metadata:
  openclaw:
    requires:
      bins: [node, omd]
    install:
      - kind: node
        package: open-market-data
        bins: [omd]
    homepage: https://github.com/anotb/open-market-data

Technical Analysis

The Skill installs the npm package open-market-data by its mutable package name without specifying an exact version, integrity hash, or lockfile. It then makes the package-provided omd executable available to a Bash-enabled Skill.

As a result, the dependency retrieved during a future installation may differ from the version originally reviewed. A compromised registry account, package takeover, malicious release, or upstream compromise could introduce arbitrary code. Such code may execute through npm installation lifecycle scripts or when the Agent invokes omd. The package implementation is not included in the audited project, so its behavior cannot be independently verified from this artifact.

Attack Path

1. An attacker compromises the open-market-data publishing account, upstream release process, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the same package name.
3. A user installs or loads the Skill, and the unversioned dependency resolves to the attacker-controlled release.
4. Malicious code executes through a package lifecycle script or a later invocation of the installed omd binary.
5. The payload performs actions with the permissions and accessible resources of the Agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the Agent user's privileges. Depending on the runtime environment, this may expose files, environment variables, configured financial-data API keys, network access, and any other resources avai ...[truncated 154 chars]

Remediation

View remediation

Remediation Suggestions

• Pin open-market-data to a specifically reviewed, immutable version rather than resolving the latest release.
• Verify and lock the package integrity hash using an appropriate lockfile or equivalent installation metadata.
• Ensure installation resolves through an explicitly trusted registry and verify that the package corresponds to the documented upstream repository.
• Review the selected package version, including dependencies, executable entry points, and npm lifecycle scripts.
• Disable installation lifecycle scripts where operationally feasible.
• Consider vendoring the reviewed implementation when reproducible installation and long-term provenance are required.
• Run the CLI with least privilege and restrict its access to credentials, files, and network destinations not required for financial-data queries.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.