ClawHub
Back to skill

Security audit

ibkr

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly for IBKR trading, but it asks users to install mutable, unreviewed remote brokerage-control code before use.

Review this carefully before installing. Use paper trading first, pin and inspect a specific commit of the `ibkr` repository before installation, avoid editable installs for normal use, and only enable live IBKR API trading when you are ready for the CLI to place real limit orders after explicit confirmation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:10
Finding

Unpinned Remote Code Retrieval and Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

text
All commands run as `ibkr <command>`. If `ibkr` is not on PATH, install it
(requires Python 3.11+ and [uv](https://github.com/astral-sh/uv)):

    git clone https://github.com/baileywickham/ibkr
    cd ibkr && uv tool install --editable .

Technical Analysis

The installation instructions clone executable source code from a remote Git repository and install it from the repository's mutable default branch. No immutable commit hash, signed release, checksum, or other integrity verification is specified.

Consequently, the code installed by a user or Agent may differ from the code that was originally reviewed. The editable installation also directly links the installed tool to the cloned working tree. Python package installation can invoke package build and installation logic, while subsequent use of the resulting ibkr command executes code obtained from the remote repository.

Although this resembles an insecure dependency practice, the principal risk is best classified as remote payload retrieval and execution because the effective executable payload can change after the Skill itself has been audited.

Attack Path

  1. An attacker compromises the referenced repository, a maintainer account, or the repository's default branch.
  2. The attacker adds malicious Python source code or package build/install logic.
  3. A user or Agent follows the instructions and runs git clone without selecting a reviewed immutable revision.
  4. The user runs uv tool install --editable ., causing the unverified package to be installed and potentially invoking attacker-controlled installation logic.
  5. Installation or later invocation of ibkr executes the malicious code with the privileges of the local user.
  6. In a brokerage workstat ...[truncated 1072 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable default-branch installation with an immutable, reviewed commit or release tag. A commit hash is preferable because tags may be moved.

  2. Check out and verify the pinned revision before installation, for example:

    bash
    git clone https://github.com/baileywickham/ibkr
cd ibkr
git checkout --detach <reviewed-full-commit-hash>
test "$(git rev-parse HEAD)" = "<reviewed-full-commit-hash>"
uv tool install .

  3. Prefer a signed release artifact from a controlled distribution channel. Publish and verify a cryptographic checksum or signature before installation.

  4. Avoid --editable for end-user installation. Install a fixed artifact so later modifications to the working tree cannot silently alter executable behavior.

  5. Pin and integrity-check transitive Python dependencies using a lockfile with hashes.

  6. Review the pinned package source, build configuration, installation hooks, and dependency graph before recommending it.

  7. Execute the CLI with least privilege and isolate it from unrelated secrets and files. Restrict local brokerage API permissions and use paper trading by default.

  8. Document a controlled update process requiring review and integrity verification before advancing the pinned revision.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.