ClawHub
Back to skill

Security audit

Kerrystock

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed financial-analysis workflow that runs local helper scripts and writes user-requested reports, with no evidence of hidden or destructive behavior.

Install only if you intend to run local financial-analysis scripts and have the referenced finance tools available. Use trusted values for NODE_BIN, PYTHON_BIN, WESTOCK_DATA_SCRIPT, NEODATA_SCRIPT, and WB_FINANCE_QUANT_DIR, and treat generated buy/sell timing as analysis rather than investment advice.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tainted flow: 'NODE' from os.environ.get (line 37, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
def export(code: str, start: str, end: str, period: str, out: str) -> pd.DataFrame:
    frames = []
    for s, e in _segments(start, end):
        outp = subprocess.run(
            [NODE, WESTOCK, "kline", code, "--period", period,
             "--start", s, "--end", e, "--fq", "qfq"],
            capture_output=True, text=True,
Confidence
91% confidence
Finding
The executable path comes from the NODE_BIN environment variable and is passed directly into subprocess.run. If an attacker can influence the environment in which this skill runs, they can replace the intended Node binary with an arbitrary executable and achieve code execution under the skill's privileges.

Tainted flow: 'cmd' from os.environ.get (line 38, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# 关键：用 --token 直传，避免 --save-token 在只读环境的写入失败
    cmd = [PY, NEODATA, "--query", args.query, "--token", args.token]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        sys.stderr.write(r.stderr)
        sys.exit(r.returncode)
Confidence
95% confidence
Finding
The command executed by subprocess.run incorporates PYTHON_BIN and NEODATA_SCRIPT from environment variables without validation. An attacker who can influence the process environment could redirect execution to a malicious interpreter or script, resulting in arbitrary code execution and possible exposure of the passed token and any accessible data.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs execution of shell commands, reads environment variables, and reads/writes local files, yet declares no permissions. This mismatch is dangerous because an agent or reviewer may treat the skill as low-privilege while it can actually access local data, persist artifacts, and invoke external tooling, increasing the risk of unintended command execution, data exposure, or unsafe file modification.

Static analysis

No suspicious patterns detected.