trading-monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:20 AM UTC
• Version: 1.2.0

Overview

The skill is mostly a stock-monitoring scheduler, but it tells users to weaken command-execution security and run missing PowerShell scripts, so it needs careful review before installation.

Install only if you understand and accept the scheduling behavior. Do not follow the advice to set tools.exec.security to full globally; prefer least-privilege allowlist entries. Do not run scripts\setup.ps1 or scripts\manage.ps1 unless you obtain them from a trusted source and inspect or verify them first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:125
• Finding: Global Disabling of Command Execution Restrictions## Vulnerability Details **File Location**: `SKILL.md:125-126` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Complete Code Snippet**: ```markdown ### Task reports "exec denied: allowlist miss" Cause: `tools.exec.security` is set to `allowlist`, but `paths` is empty. Fix: Run `openclaw config set tools.exec.security full`, then restart the gateway. ``` The same unsafe recommendation also appears in `references/config-guide.md:77`: ```markdown 1. Task reports "exec denied" → `openclaw config set tools.exec.security full` ``` ### Technical Analysis The documented remediation changes OpenClaw command execution security from an allowlist model to unrestricted execution. An allowlist establishes a least-privilege boundary by limiting the agent to explicitly approved executables. Setting the mode to `full` removes that boundary globally instead of authorizing only the commands legitimately required for stock monitoring. This configuration change is broader than the Skill's declared purpose. The Skill needs to create and manage cron tasks, but it does not establish that unrestricted access to every executable on the host is necessary. The recommendation also instructs the user to restart the gateway, causing the weakened configuration to take effect beyond the immediate troubleshooting operation. ### Attack Path 1. The user encounters an `allowlist miss` while configuring or running the Skill. 2. The user follows the documented troubleshooting command and changes `tools.exec.security` to `full`. 3. The user restarts the gateway, activating unrestricted command execution. 4. A subsequently loaded malicious Skill, compromised instruction source, prompt-injected task, or attacker-controlled agent input requests execution of an arbitrary local command. 5. Because the allowlist boundary has been removed, the command can execute with the operating-system privileges of the ...[truncated 659 chars]
• Remediation: ## Remediation Suggestions - Keep `tools.exec.security` configured in allowlist mode. - Identify the exact trusted executable paths required for cron administration and add only those paths to the allowlist. - Restrict executable arguments or command patterns where the platform supports argument-level controls. - Run the gateway under a dedicated, unprivileged operating-system account with access only to the files and services required by the Skill. - Do not present unrestricted execution as a general troubleshooting fix. - Add instructions for reviewing denied commands and approving them individually. - Document how to restore the secure configuration after testing and verify the effective configuration after gateway restart. - Replace the same unsafe recommendation in `references/config-guide.md:77`.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17
• Finding: PowerShell Execution Policy Bypass for Missing and Unverifiable Scripts## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Complete Code Snippet**: ```powershell powershell -ExecutionPolicy Bypass -File scripts\setup.ps1 -Channel feishu -Target "ou_your_ID" ``` A similar command is documented at `SKILL.md:37`: ```powershell powershell -ExecutionPolicy Bypass -File scripts\manage.ps1 list ``` Neither `scripts/setup.ps1` nor `scripts/manage.ps1` is present in the audited project. The package contains only `SKILL.md`, `_meta.json`, and `references/config-guide.md`. ### Technical Analysis `-ExecutionPolicy Bypass` launches PowerShell without applying the normal execution-policy checks for that process. Although PowerShell execution policy is not a complete security boundary, bypassing it suppresses a defense-in-depth control that can otherwise warn about or block scripts based on local policy, source, or signing requirements. The risk is amplified because the referenced scripts are absent from the audited artifact. Their content, origin, integrity, and behavior therefore cannot be verified. A user may obtain the files from an external or untrusted source, or an attacker with write access to the expected path may place a malicious script there. The documented command would then execute that script with the user's current privileges while explicitly bypassing policy enforcement. ### Attack Path 1. A user follows the documented one-click deployment or management instructions. 2. Because the referenced script is missing, the user obtains a same-named script elsewhere, or an attacker places `scripts/setup.ps1` or `scripts/manage.ps1` in the expected working directory. 3. The user invokes the documented command with `-ExecutionPolicy Bypass`. 4. PowerShell executes the unverified script without applying the process's normal execution-policy restrictions. 5. The malicious script performs actions ava ...[truncated 772 chars]
• Remediation: ## Remediation Suggestions - Include `scripts/setup.ps1` and `scripts/manage.ps1` in the distributed package so their behavior can be reviewed and versioned with the Skill. - Remove `-ExecutionPolicy Bypass` from all documented commands. - Digitally sign distributed PowerShell scripts and recommend an execution policy that validates signatures. - Publish cryptographic hashes for released scripts and instruct users to verify integrity before execution. - Resolve script paths relative to a trusted installation directory rather than the caller's arbitrary working directory. - Ensure the trusted script directory is not writable by untrusted users. - Document the exact operations and permissions required by each script. - Update the corresponding script references in `references/config-guide.md` so users are not directed toward absent or unverifiable files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad (`盯盘`, `设置分析`, `调整频率`, etc.) and can match ordinary conversation, causing the skill to activate unexpectedly. In this skill, unintended activation is more dangerous because it can create, modify, stop, or trigger automated cron tasks that send reports or change monitoring behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation includes destructive task deletion commands and elsewhere recommends broad exec-security weakening, but does not prominently warn users about the operational and security consequences. In a scheduling skill, this can lead to accidental loss of tasks or unsafe system-wide configuration changes by users following copy-pasted instructions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly tells users to change `tools.exec.security` to `full` globally in order to bypass an allowlist failure. That weakens execution controls far beyond what a stock-monitoring scheduling skill should require, increasing the risk that scheduled prompts or future tasks can execute arbitrary commands with fewer restrictions.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The skill content and invocation guidance are entirely in Chinese, with no indication that users may opt for another language or locale. For a general-purpose skill file, this can be interpreted as a language policy constraint without explicit user opt-in or justification.

Static analysis

No suspicious patterns detected.