ClawHub
Back to skill

Security audit

Stock Trader

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Trade It trading integration, but it gives agents authenticated paths that can place real orders before per-trade confirmation and includes an arbitrary authenticated tool dispatcher.

Review this skill carefully before installing. It needs a Trade It token that can view brokerage data and place trades, and some create calls may submit real orders before a separate execution step. Use only with deliberately limited accounts or hosted review flows, avoid yolo/immediate-placement settings, and do not allow generic tool-execute or unredacted output in normal use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/tradeit_api.py:143
Finding

Unrestricted Authenticated Tool Dispatcher

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:177
Finding

Trade Creation Can Place a Real Order Before Explicit Confirmation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tradeit_api.py:61
Finding

HTTP Error Responses Bypass Sensitive-Data Redaction

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tradeit_api.py:121
Finding

Command-Line Token Input and Raw-Output Option Can Expose Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

https://api.tradeit.app

text

Use bearer auth in all cases. `TRADEIT_ACCESS_TOKEN` may be an API key token or an OAuth access token.

## Error handling contract

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 20)May include surrounding context.

md
- holdings
  - and to send buy/sell orders on the user's behalf
- Trade It **NEVER** sells or shares user data with third parties.
- Trade It **NEVER** stores usernames or passwords; it stores revocable access tokens.
- Data is encrypted at rest and in transit using bank-level security protocols.
- OAuth is used whenever possible. For brokerages without OAuth, Trade It uses API keys or securely exchanges credentials for an access token.
- Users can revoke access directly from their brokerage or by deleting a connection on Trade It at any time.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
- Trade It **NEVER** sells or shares user data with third parties.
- Trade It **NEVER** stores usernames or passwords; it stores revocable access tokens.
- Data is encrypted at rest and in transit using bank-level security protocols.
- OAuth is used whenever possible. For brokerages without OAuth, Trade It uses API keys or securely exchanges credentials for an access token.
- Users can revoke access directly from their brokerage or by deleting a connection on Trade It at any time.
- Trade It's access is limited: it is unable to withdraw, transfer, or take custody of money or assets; it can only place trades on the user's behalf.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 22)May include surrounding context.

md
- Trade It **NEVER** sells or shares user data with third parties.
- Trade It **NEVER** stores usernames or passwords; it stores revocable access tokens.
- Data is encrypted at rest and in transit using bank-level security protocols.
- OAuth is used whenever possible. For brokerages without OAuth, Trade It uses API keys or securely exchanges credentials for an access token.
- Users can revoke access directly from their brokerage or by deleting a connection on Trade It at any time.
- Trade It's access is limited: it is unable to withdraw, transfer, or take custody of money or assets; it can only place trades on the user's behalf.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that trade creation may place an order immediately for some users, but it does not present that behavior as a prominent safety warning. In a trading skill, ambiguous create-vs-execute semantics can cause unintended live orders and direct financial loss if an agent or user assumes create is always non-committal.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The execute_trade endpoint is an explicit commit action for a live trade, yet the reference describes it functionally without a strong user-facing safety warning. In this skill context, under-warning a live asset-moving operation materially increases the risk of unauthorized or accidental trade execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example flow explicitly allows immediate trade placement when 'yolo mode' is enabled, but it does not require a clear, explicit user confirmation at execution time or present a strong warning about irreversible financial impact. In a trading skill that can place real brokerage orders, normalizing one-step execution materially increases the risk of unintended or manipulated transactions, especially if upstream prompts, account selection, or order details are misunderstood.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes create-trade, create-options-trade, and execute-trade actions with no built-in confirmation, dry-run, or user acknowledgement step before irreversible financial operations. In a skill context, especially one callable by an agent, this increases the risk of accidental, unauthorized, or prompt-induced trades that can cause immediate monetary loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code retrieves TRADEIT_ACCESS_TOKEN and sends it in the Authorization header on every API request, which is sensitive credential handling and network transmission. Although this behavior is expected for an API client, the file itself contains no user-facing message, comment, or docstring disclosing that credentials from the environment will be used and transmitted to the Trade It service.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/tradeit_api.py (reported line 106)May include surrounding context.

python
def build_trade_query(args):
    query = {}
    for key in ("order_by", "filter", "cursor", "refresh", "expand"):
        val = getattr(args, key)
        if val is not None:
            query[TRADE_QUERY_KEY_MAP.get(key, key)] = val
    return query

Static analysis

No suspicious patterns detected.