ClawHub
Back to skill

Security audit

Clawhub

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed financial-claims indexing and charting workflow, with the main caution that it runs a separately installed pinned GitHub runtime outside the reviewed package.

Install only if you are comfortable cloning and running the pinned external runtime, and review or sandbox that runtime if you need stronger assurance. Keep the workspace and SQLite database in a directory you control, approve network access only when you want chart data or CDN-backed HTML, and use the automation/cron mode only with an explicit schedule you understand.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/runtime.md:28
Finding

Externally Hosted Runtime Executes Code Outside the Audited Package

Content
View full analysis

Vulnerability Details

File Location: references/runtime.md:28-52
Vulnerability Type: Externally sourced executable dependency
Risk Level: Medium

The skill is documentation-only and directs the agent to clone and execute a separately hosted Python runtime that was not included in the audited artifact.

bash
git clone --depth 1 --branch openclaw-v0.1.6 \
  https://github.com/bzSega/financial-experts-said.git "$FES_ROOT"
bash
# must output exactly: openclaw-v0.1.6
git -C "$FES_ROOT" describe --exact-match --tags HEAD

# must equal the pinned SHA from the table above
if [ "$(git -C "$FES_ROOT" rev-parse HEAD)" != "419cafe0a833d470867d3bd0e1c77773c6ff1095" ]; then
  echo "pin mismatch" >&2
  exit 1
fi
bash
python3 "$FES_ROOT/pipeline/init_db.py" --db "$FES_WORKSPACE/fti.db"
python3 "$FES_ROOT/pipeline/seed_demo.py" --db "$FES_WORKSPACE/fti.db"   # demo data

Technical Analysis

The package delegates its core functionality to executable files obtained from an external GitHub repository. Those files are outside this artifact and therefore could not be examined during this audit. Running them gives the external runtime the same operating-system privileges and data access as the invoking agent or user.

The exact Git tag and commit verification significantly reduce the risk of silently receiving a different revision. Consequently, this is best categorized as an insecure external dependency boundary rather than an unpinned remote-payload mechanism. However, hash pinning verifies identity, not safety: it does not establish that the pinned Python code is benign.

The affected runtime includes database initialization and demo-data scripts, while other project instructions also direct the agent to invoke ingestion, synchronization, search, and chart scripts from the same external runtime.

Attack Path

  1. A user asks the agent to set up or use the skill.
  2. The agent f ...[truncated 1392 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include the complete reviewed runtime source in the distributed package so that the instructions and executable implementation can be audited together.
  2. Alternatively, publish a signed, immutable release archive and verify both its cryptographic signature and a documented SHA-256 digest before extraction or execution.
  3. Retain the exact commit verification, but treat it as an integrity control rather than proof that the runtime is safe.
  4. Subject the pinned runtime commit to a separate code audit covering file access, subprocess execution, network behavior, SQLite handling, HTML generation, and source-text processing.
  5. Require explicit user approval before cloning the runtime and separate approval before its first execution.
  6. Execute the runtime with least privilege, restricted filesystem access, and outbound network controls appropriate to the selected operation.
  7. Document the files, network endpoints, and subprocesses each runtime command is expected to access so unexpected behavior can be blocked or detected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'Когда использовать' section lists example phrases like 'что говорил эксперт X об активе Y' and 'добавь источник в базу тезисов' without clarifying whether these are the only trigger phrases, what context is required, or when the skill should not activate. Such phrasing could overlap with ordinary research or note-taking requests and may cause unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's user-facing instructions and invocation examples are predominantly in Russian, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Russian-speaking or region-specific context. This can violate language/locale policy when a specific language is effectively forced without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.