AI stock watchdog

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 2.2.0

Overview

This is a coherent stock-monitoring skill with local portfolio storage; it is not malicious, but users should treat holdings and broker screenshots as sensitive.

Before installing, understand that your holdings, average prices, preferences, alerts, and comparison history are stored in local skill files. Prefer text entry or redact broker screenshots, review the files periodically, and only enable the scheduled scan if you are comfortable with recurring local state updates and web searches for your holdings.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: PUBLISH.md:10

Finding

Unpinned and Unverified Global npm CLI Installation

Content

View full analysis

Vulnerability Details

File Location: PUBLISH.md:10
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code Snippet

markdown

| ClawHub CLI installed | `npm install -g @openclaw/clawhub-cli` (verify package name in current docs) |

Technical Analysis

The publishing guide instructs maintainers to globally install @openclaw/clawhub-cli without specifying an exact version or integrity value. The same instruction explicitly indicates that the package name has not been verified.

Consequently, npm resolves the package's current distribution tag at installation time. The installed content can therefore differ from what was reviewed when this project was published. A compromised package release, compromised maintainer account, or incorrectly documented package name could deliver arbitrary package lifecycle scripts. Global installation also exposes the package's executable through the user's command search path, increasing the effect of a malicious or compromised release.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the referenced npm package, its publisher account, or the associated release process and publishes a malicious version under the resolved distribution tag.
2. A maintainer follows PUBLISH.md and runs:

   bash

   npm install -g @openclaw/clawhub-cli
   

3. npm downloads the unpinned release and may execute package lifecycle scripts during installation.
4. Malicious installation code runs with the privileges of the account invoking npm.
5. The globally installed CLI can subsequently intercept publishing credentials, GitHub OAuth material available to the process, repository contents, or future commands executed through the spoofed CLI.

Impact Assessment

Successful exploitation can provide arbitrary code executio ...[truncated 704 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify the official package name and installation procedure against authoritative ClawHub documentation before recommending it.
2. Pin an audited exact version rather than resolving the latest distribution tag:

   bash

   npm install -g @openclaw/clawhub-cli@<verified-version>
   

3. Record and verify the expected package provenance, publisher identity, and integrity metadata before installation.
4. Prefer a lockfile-controlled, project-local development dependency over a global installation where the supported workflow permits it.
5. Use npm provenance verification and review the package contents and lifecycle scripts before installation.
6. Consider installing with lifecycle scripts disabled when compatible:

   bash

   npm install -g --ignore-scripts @openclaw/clawhub-cli@<verified-version>
   

7. Perform publishing from a minimally privileged, isolated environment without unrelated credentials or repositories mounted.
8. Update the guide whenever the verified CLI version changes, documenting the source and date of verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes clawhub sync as a command that will "publish all changed skills" but does not include an explicit warning about the scope or consequences of that action. Because publishing can expose code or metadata publicly and affect repository integrity, the description should clearly warn users before presenting the non-dry-run bulk action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly encourages users to share holdings details and broker screenshots, and states that portfolio data is stored in local skill files, but it does not warn about the sensitivity of this financial data or explain retention, access, or deletion behavior. This can lead users to expose personally sensitive investment information without understanding the privacy implications, especially if the agent environment syncs, logs, or backs up skill state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation triggers include very broad natural-language phrases such as "I bought", "I sold", and "add to portfolio" that commonly occur in ordinary investing conversations. This can cause the skill to activate unintentionally and read or modify portfolio-related files or start monitoring workflows when the user did not explicitly intend to invoke the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The routing table maps ambiguous phrases like "check my stocks", "morning brief", "scan", and "anything I should know" directly into the Daily Monitoring Workflow. In context, this workflow reads portfolio state, performs external searches, and may write alerts/state files, so ambiguous routing increases the chance of unintended execution and unnecessary data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages users to upload broker-app screenshots, which commonly contain sensitive financial information such as holdings, account identifiers, balances, and other personal data. In a portfolio-monitoring context this collection path is unnecessary if safer text-based entry is available, and the lack of any warning or minimization guidance increases the chance of oversharing and privacy exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example explicitly describes persistent writes to alerts/2026-05-01-alert.md, state/last-run.json, and stored portfolio-related comparison data while the skill is 'silent by default' and gives no user-facing disclosure or consent mechanism. Silent persistence is dangerous because it can retain sensitive financial holdings, behavioral inferences, and monitoring history in ways the user may not expect, increasing privacy, integrity, and forensic risk if the environment is shared or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 61% confidence

Finding

The document prescriptively says to use the listing title AI stock watchdog, which imposes a specific English title without mentioning user choice or locale considerations. While mild, this is a natural-language locale preference embedded in the guidance rather than an opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file hard-codes "Asia/Kolkata" and "INR" as default preferences, which imposes a specific regional locale on all users. The provided text does not indicate that this is region-specific or that users are offered a choice before these defaults are applied.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.