Security audit

Investor Search for nanobot

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built rather than malicious, but it needs review because it persistently stores investor-research data and can automatically post generated Excel files into shared chats.

Install only if you are comfortable with a skill that writes persistent investor-research files in the agent workspace and may attach the final workbook to the current chat, including shared channels. For team or public bots, use a separate workspace per team/user and prefer a pinned installer version instead of `@latest`.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (18)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
| `SKILL.md` | working — every operative rule, nothing else |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
| `SKILL.md` | working — every operative rule, nothing else |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The README instructs users to install and run a package via npx --yes clawhub@latest, which explicitly tracks the newest published code rather than a reviewed, immutable version. That creates a supply-chain risk: if the upstream package is compromised or a malicious release is published, users of this skill may execute attacker-controlled code during install/update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This installation command again relies on npx --yes clawhub@latest, causing execution of whatever the current latest upstream package is at runtime. Because npx fetches and runs code, an attacker who can influence the upstream package or dependency chain could achieve arbitrary code execution on the operator's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The update instructions also use npx --yes clawhub@latest, which means every update trusts the newest upstream release without pinning or review. In the context of a skill that also uses exec and writes to the workspace, compromise of the installer path could expose local files or lead to broader agent/environment compromise.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 104)May include surrounding context.
md
attached — only counted. If you run a bot for several people, the safest setup is one agent per team, each with its own workspace. **Scheduled runs** (cron jobs) continue a stored market without asking; anything that would need a question — a different scope, a shared folder — stops before the first search and reports the question instead.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs sensitive file read/write operations and shell execution orchestration, but it does not declare an explicit tool scope such as allowed-tools or permissions. In practice this increases the chance the host agent will grant broader capabilities than intended, making accidental or unsafe file access more likely, especially because the skill heavily manipulates persistent workspace data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The installation command uses npx --yes clawhub@latest, which pulls the latest package version at install time rather than a pinned, reviewed version. That creates a supply-chain risk: a compromised or malicious future release could change behavior, gain broader access, or exfiltrate workspace data without any change to this skill file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file explicitly lists broad activation conditions such as any request for investors in a country, region, or market, plus generic uses like CRM enrichment and fundraising prospect lists. The trigger scope is expansive and does not provide negative examples or clear exclusion boundaries, which increases the risk of unintended invocation for ordinary research requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is designed to post the generated Excel file into channels or shared chats, but the main description does not prominently warn about the privacy implications up front. Because the file may contain sensitive prospecting data, notes, and source aggregation, automatic delivery into a shared context can disclose business intelligence to unintended recipients.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The instruction to send the Excel deliverable 'WITHOUT asking' authorizes autonomous external action in a chat context. In shared or misidentified contexts, this can disclose generated data to unintended recipients without a fresh consent check at the point of release.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
WhatsApp, Discord, -investors.xlsx, arrives as an attachment in this chat. This …) is a file the user asked for, so the message tool is the right way to send it. Never attach the CSVs: they are the memory, not the deliverable. Send it WITHOUT asking — in a channel too (see §6). CLI / WebUI state the absolute path; in the WebUI also send it with media. cron job send it with the message tool's media to the job's chat.

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: This instruction again permits posting the finished Excel file to everyone in a channel without asking again. Even with a one-time notice, the model may misunderstand the audience or the sensitivity of the compiled investor data, leading to unauthorized disclosure in shared workspaces.
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.
md
(*nanobot* above). **In a channel, say once in the first reply that the finished Excel file will be posted here for everyone in it.** That notice is the only one: at the end, post the file without asking again. **Use a separate root per user or team whenever the session context names one.**

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 627)May include surrounding context.
md
**There is no budget unless the user sets one.** By default the run continues until the exhaustion rule is met — six empty rounds in a row, with the gates open — and `finish` allows the stop. **Never ask the user for a budget.** If the user names a number ("use 10 rounds", "quick scan"), pass it as `init --budget N`. **Sixty rounds is the backstop** for a run without a budget; a user who explicitly asks for more gets their number after one sentence on what it costs.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file directs that the report and files be sent in the chat app, and later requires disclosing the local folder path where files were written. Those behaviors can affect user data visibility and system privacy, but the document provides no warning or caution about exposing file locations or transmitted report contents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code writes an XLSX output file, creates output directories, and copies multiple market data files to an export location. While the module docstring describes command usage, the command implementations themselves provide no confirmation prompt or explicit user-facing warning at execution time that files will be created or overwritten in the specified output directory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The import path writes uploaded ledger files into the market folder, may write rounds.csv and .run.json, and temporarily renames files during processing. These are safety-relevant filesystem changes, but the function does not emit a direct warning or confirmation before modifying on-disk state.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE (reported line 12)May include surrounding context.
text
permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Lines L029-L031 require using the English short name and explicitly reject local-language names. This is a natural-language locale policy constraint, and the file does not offer user choice or explain a compliance or interoperability need strong enough to make the restriction user-optional.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.