ClawHub
Back to skill

Security audit

Shanv Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a trading assistant with disclosed trading goals, but its executable code can bypass the promised confirmation and risk controls and can record simulated trades as successful.

Only install after review if you are comfortable testing an incomplete trading prototype. Do not connect it to a live brokerage or rely on its trade logs until execution requires explicit user confirmation, enforces risk checks at the executor, validates stock codes and quantities, removes shell=True interpolation, and clearly separates simulation from real trading.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
monitor_positions.py:56
Finding

Shell Command Injection Through Unvalidated Stock Codes

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
execute_trade.py:139
Finding

Direct Trade Execution Bypasses Declared Confirmation and Risk Controls

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
execute_trade.py:65
Finding

Fabricated Trade Success and Hard-Coded Fill Prices Spoof Execution Results

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The CLI immediately executes buy or sell operations based on provided arguments and then updates holdings, with no confirmation prompt, approval gate, dry-run default, or transaction review step. In the context of trading, these are irreversible or financially significant actions, so accidental invocation, malformed automation input, or misuse by another agent could cause direct monetary loss.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This is a tool-parameter abuse issue because externally influenced values are passed directly into a shell command. In a trading-monitoring skill, that context increases risk: malformed or malicious portfolio symbols could trigger command injection and compromise the host, exposing sensitive account files or enabling arbitrary code execution.

Content

Scanner excerpt · monitor_positions.py (reported line 60)May include surrounding context.

python
# 调用 stock_price 或 unified_stock
    import subprocess
    code_str = ' '.join(codes)
    result = subprocess.run(
        f'cd ~/.openclaw/workspace && python3 bin/stock_price {code_str}',
        shell=True,
        capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly records trade logs, memory archives, and portfolio tracking data, which are likely to contain sensitive financial activity and account-related information. In a trading context, undocumented retention and lack of warning increase privacy and compliance risk because users may not understand what is stored, for how long, or who can access it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains user-facing natural language entirely in Chinese, including the skill title and workflow description, and later prompts users to respond in that language. The file does not offer any language selection or opt-in, which can violate language/locale policy for general-purpose skills.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · demo_trade.py (reported line 17)May include surrounding context.

python
print("🔍 步骤1: 扫描市场机会...")
    print("-" * 50)
    
    result = subprocess.run(
        ['python3', 'bin/unified_scanner.py'],
        cwd=Path.home() / '.openclaw/workspace',
        capture_output=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file advertises itself as a trade executor that buys, sells, and cancels through a platform API, but the implementation only simulates successful buy/sell results with hardcoded prices and does not perform the claimed actions. In a trading context, this mismatch is dangerous because operators or downstream agents may believe real orders were placed and make financial decisions based on false execution state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script invokes subprocess-driven automation to unlock the trading interface, which implies direct control of a trading platform, but it provides no prominent safety interlock or warning before doing so. In this skill context, silent UI automation against a brokerage/trading environment increases the chance of unintended account actions and makes abuse by higher-level automation more dangerous.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · execute_trade.py (reported line 50)May include surrounding context.

python
def unlock_trading():
    """解锁交易界面"""
    print("🔓 解锁交易界面...")
    result = subprocess.run(
        ['python3', 'flow_executor.py', '4'],
        cwd=Path.home() / '.openclaw/workspace/openclaw-platform',
        capture_output=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The inline comments claim the code is invoking a coordinate-platform buy flow, but the actual implementation fabricates a success response and hardcoded execution price. In an automated trading workflow, this can mislead users, orchestration systems, or audit processes into treating simulated trades as completed orders, creating financial and operational risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · execute_trade.py (reported line 126)May include surrounding context.

python
"""更新持仓数据"""
    print("\n📝 更新持仓数据...")
    
    result = subprocess.run(
        ['python3', 'holdings_update.py'],
        cwd=Path.home() / '.openclaw/workspace/openclaw-platform',
        capture_output=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s title, descriptions, and all user-facing output are exclusively in Chinese, indicating the skill is designed to operate in a single language without offering user opt-in or an alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The code builds a shell command by concatenating untrusted stock codes into a string and executes it with shell=True. If any code value contains shell metacharacters, an attacker could execute arbitrary commands in the user's environment, which is especially dangerous because the script operates inside the user's workspace and reads trading/account data.

Content

Scanner excerpt · monitor_positions.py (reported line 60)May include surrounding context.

python
# 调用 stock_price 或 unified_stock
    import subprocess
    code_str = ' '.join(codes)
    result = subprocess.run(
        f'cd ~/.openclaw/workspace && python3 bin/stock_price {code_str}',
        shell=True,
        capture_output=True,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring describes the skill as a 'trade suggestion generator' that produces buy suggestions and waits for confirmation, which implies recommendation generation as its primary behavior. Later, the code writes pending suggestions to a JSON file, adding a persistent state-changing side effect not reflected in that top-level documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module description and user-facing interaction strings are written entirely in Chinese and the workflow expects Chinese responses such as '确认买入' or '取消'. This imposes a specific language/locale on users without any opt-in or documented justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · suggest_trades.py (reported line 33)May include surrounding context.

python
"""扫描芯片板块机会"""
    # 调用 unified_scanner.py --chip --top 5
    import subprocess
    result = subprocess.run(
        ['python3', 'scripts/unified_scanner.py', '--chip', '--top', '5'],
        cwd=Path.home() / '.openclaw/workspace',
        capture_output=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The natural-language instructions and interface examples are entirely presented in Chinese, and the document does not indicate that users may select another language or locale. Under the stated policy, forcing a specific language without opt-in is a language/locale policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and all CLI-facing messages are written in Chinese, and there is no indication that the user can opt into another language or that the tool is intentionally limited to a Chinese-only audience. This can violate language/locale policy when skills impose a specific language without user choice.

Content

No source excerpt is available for this finding.