ClawHub
Back to skill

Security audit

Global Financial Downloader

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible financial-report downloader, but it needs review because it shells out to external scripts with unvalidated user input and depends on code outside the package.

Review before installing. Use only ordinary stock codes and documented report types, run --dry-run first, and inspect or trust the referenced external scraper scripts before relying on it. Avoid custom --type values and avoid creating the optional /usr/local/bin helper unless you deliberately want a global command.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print()
        
        try:
            result = subprocess.run(
                cmd, shell=True,
                stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                universal_newlines=True,
Confidence
98% confidence
Finding
The code invokes subprocess.run with shell=True on a command string assembled from user-influenced values such as stock identifier-derived fields and report type. This enables shell metacharacter injection if any mapped name, identifier, or future input source contains characters interpreted by the shell, leading to arbitrary command execution in the agent environment.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The safety claim is misleading: although os.system was replaced, the implementation still executes via a shell, preserving the main injection risk. Misleading security comments increase danger because maintainers may assume the code is hardened and stop scrutinizing command construction.

Missing User Warnings

Low
Confidence
75% confidence
Finding
The skill instructs users to perform network downloads from multiple external financial data sources and to write results to local directories, but it does not explicitly warn about outbound connections, local storage locations, or possible privacy/compliance implications. In an agent environment, silent network access and disk writes can surprise users, leak query interests, or store regulated financial documents in unintended locations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Commands for CN/US downloads are constructed by interpolating user-controlled or user-selected values directly into shell strings, including stock code, company name, and report type. In this skill context, the tool is specifically intended to run external scrapers, so command execution is expected and reachable, making input-to-shell injection materially dangerous.

Static analysis

No suspicious patterns detected.