Security audit

OpenClaw Backtester

Security checks for vulnerabilities and agentic risk

Overview

This is a limited, read-only local stock backtesting helper that overstates some features, but it does not show hidden execution, persistence, credential access, or data exfiltration.

Install only if you are comfortable with a beta-quality local backtester that reads a disclosed OpenClaw trading SQLite database and has overstated documentation. Do not rely on its results for real trading decisions without independently validating the calculations, dependencies, data quality, and missing advertised features.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill documentation presents a broader and safer-seeming capability set than what is actually described in the behavior notes, including undisclosed access to a local SQLite database path and overstated functionality. In an agent setting, description-behavior mismatch is dangerous because users and orchestrators may grant trust or invoke the skill under false assumptions, leading to unintended local data access or misuse of incomplete backtesting results.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation switches into Chinese for major instructional sections, including design-pattern headings and explanatory text, but does not state that the skill is Chinese-only or give users an option to choose language. This can violate language/locale policy expectations because the skill imposes a language on users without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file includes its primary docstring entirely in Chinese, and later user-facing CLI descriptions and output are also presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly justified, which is not documented here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a professional backtesting framework that supports SMA crossover, RSI, MACD, Bollinger Bands, and custom strategies, and generates equity curves, drawdown analysis, and performance metrics. In this file, only four hard-coded strategy functions are available via CLI choices, no custom strategy mechanism exists, and no equity curve output or broader metric suite is generated beyond a few printed values.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The argument parser descriptions, help strings, and printed backtest results are all hard-coded in Chinese. This enforces a single locale for end users without offering a language choice or documenting a justified regional limitation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The comments say entries are '0->1 (buy)' and exits include '1->0/-1 or -1->0/1 (sell)', but the code filters for position values of 2 and -2, which correspond to direct flips between -1 and 1 rather than 0-to-1 or 1-to-0 transitions. Although these variables are not used later, the inline documentation actively misstates what the code is selecting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.