ClawHub
Back to skill

Security audit

Fund Advisor Cn

Security checks for vulnerabilities and agentic risk

Overview

The skill is a fund-advice calculator with no evidence of exfiltration or destructive behavior, but it gives actionable financial recommendations and silently persists some financial command history locally.

Review before installing. This skill should not be treated as a licensed financial adviser: its allocation, rebalancing, and Kelly outputs are generic calculations and may be unsuitable for your circumstances. Avoid entering sensitive transaction descriptions unless you are comfortable with local plaintext history being written under the fund-advisor-cn data directory, and inspect or delete that directory if needed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/script.sh:5
Finding

Financial transaction descriptions are persisted in plaintext with inherited filesystem permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 5-7 and 25-30
Vulnerability Type: Plaintext storage of potentially sensitive financial data
Risk Level: Medium

Vulnerable Code

bash
DATA_DIR="${FUND_ADVISOR_CN_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/fund-advisor-cn}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
bash
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

cmd_track() {
    echo "  Transaction: $1 Amount: ${2:-0}"
    _log "track" "${1:-}"
}

Technical Analysis

The track command writes the user-supplied transaction description to history.log in plaintext. The script creates the data directory and log file without explicitly applying restrictive permissions. Their effective permissions therefore depend on the invoking user's umask and the permissions of a caller-controlled FUND_ADVISOR_CN_DIR.

Under common permissive defaults, the directory may be created with mode 0755 and the log with mode 0644. This can expose transaction descriptions to other local accounts or processes that can read the selected directory. The persistence of this information is also not disclosed in SKILL.md, which presents the project primarily as an investment-advice and calculation tool.

The amount supplied to cmd_track is displayed but is not written by _log; the confirmed exposure is the transaction description and associated timestamp.

Attack Path

  1. A user invokes the documented executable with a sensitive description, for example:
    bash
    fund-advisor-cn track "Medical debt payment" 5000
  2. cmd_track passes the description to _log.
  3. _log appends the timestamp, operation name, and description to:
    text
    ~/.local/share/fund-advisor-cn/history.log
    or to the path selected through FUND_ADVISOR_CN_DIR.
  4. If inherited directory and file permissions allow access, another ...[truncated 953 chars]
Remediation
View remediation

Remediation Suggestions

  1. Establish a restrictive process umask before creating any storage:

    bash
    umask 077

  2. Create the application directory with owner-only permissions and verify existing directories:

    bash
    mkdir -p -m 700 -- "$DATA_DIR"
chmod 700 -- "$DATA_DIR"

  3. Create and maintain log files with mode 0600:

    bash
    touch -- "$DATA_DIR/history.log"
chmod 600 -- "$DATA_DIR/history.log"

  4. Do not persist transaction descriptions by default. Require explicit opt-in or log only a non-sensitive event such as transaction recorded.

  5. Clearly document what data is retained, where it is stored, how long it is retained, and how users can inspect or delete it.

  6. Provide commands to clear history and configure retention limits. Consider automatic redaction or bounded log rotation.

  7. Validate a caller-provided FUND_ADVISOR_CN_DIR before use. Reject unsafe destinations such as shared or world-writable directories, and check for symbolic-link or ownership issues before writing.

  8. If retaining sensitive transaction details is a required feature, consider encryption at rest using operating-system credential storage or a user-managed encryption key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly says to use the skill when making fund investment decisions, which is an overly broad activation scope for a finance-oriented skill. This can cause the agent to invoke the skill for personalized or consequential financial guidance without clear limitations, suitability checks, or advice disclaimers, increasing the risk of unsafe financial recommendations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The repeated description again frames the skill as appropriate for general investment decision-making and portfolio actions such as asset allocation and rebalancing, without defining boundaries or requiring risk/suitability context. In this domain, broad activation increases the chance the system will rely on the skill for actionable financial advice that may be inappropriate for a user's circumstances.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The asset-allocation logic provides concrete portfolio recommendations, expected returns, and behavioral advice without any warning that outputs are generic, non-fiduciary, and unsuitable as personalized financial advice. In a skill intended to guide investments, this increases the chance that users act on oversimplified recommendations that do not account for suitability, legal/regulatory requirements, or financial harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Kelly-criterion feature gives position-sizing guidance including statements that can normalize heavy allocation, while only lightly qualifying that half-Kelly is safer. Because Kelly sizing is highly sensitive to input errors and estimation bias, presenting it without strong warnings can encourage dangerous overbetting and outsized losses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The header and help text describe commands such as track, balance, summary, budget, compare, and forecast as real financial features. However, the implementations mostly just echo static strings and append command names to a history log, without recording transactions to the declared data store or computing balances, summaries, comparisons, or forecasts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
72% confidence
Finding

The name "fund-advisor-cn" suggests a Chinese locale or region-specific variant, but the file does not explain the locale restriction or provide any opt-in or alternative. Under the language/locale policy, forcing a specific locale without user choice or justification can be a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script logs user-supplied transaction-related data to local files under a persistent data directory without explicit disclosure, consent, or access controls. Financial descriptions and related metadata can contain sensitive personal information, and silent persistence increases privacy risk, especially on shared systems or where home-directory backups and indexing expose the files more broadly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

Nearly all user-facing strings, help text, and usage guidance are presented only in Chinese, with no indication that the skill is intentionally region-specific or that users may select another language. This can violate language/locale policy when a skill imposes a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The help text does not fully enumerate implemented commands such as sharpe, maxdd, kelly, monte, fire, var, irr, and cost, which means users and reviewers may underestimate the script's capabilities. While this is not code execution risk, incomplete self-documentation reduces transparency and can hide higher-risk features from casual inspection or policy review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.