InvestmentTracker Platform

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:35 PM UTC
• Version: v1.0.2

Overview

The skill’s investment-tracking purpose is coherent, but the package exposes live-looking API credentials across executable code, configs, and documentation and can send credentialed requests for sensitive financial data.

Review before installing. Do not use this package with real accounts unless the exposed tokens have been revoked and removed, credentials are supplied by each user through a protected secret mechanism, logs redact auth headers, and network calls require clear user intent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:4

Finding

Live API Credentials Committed Across Source Code, Configuration, Tests, and Documentation

Content

View full analysis

Vulnerability Details

File Location: config.json:4-9; additional occurrences include final_skill.py:17-18, scripts/fetch_data.py:27-30, mcp_config.json:4-7, test_mcp_sse.py:74-81, test_mcp_protocol.py:112-113, and test_updated_api.py:58-60.

Vulnerability Type: Hardcoded authentication credentials
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "investmenttracker": {
      "url": "https://claw.investtracker.ai/mcp",
      "headers": {
        "Authorization": "Bearer it_live_IGWL2ZjlCHmxHCHMV_AFU87xz0CszLrJTCvfzs5gAjo",
        "Accept": "application/json, text/event-stream",
        "Content-Type": "application/json"
      }
    }
  }
}

Another shared credential is directly embedded in executable code:

python

class FinalInvestmentTracker:
    """Final investment tracker using the MCP API."""
    
    def __init__(self):
        self.api_url = "https://investmenttracker-ingest-production.up.railway.app/mcp"
        self.api_key = "it_live_E8MnP28kdPmgpxdjfRG1wzUB9Nr7mCiBU34NjFkAPes"

Technical Analysis

The project contains two live-looking API credentials. One shared credential appears 78 times across Python files, shell scripts, JSON configuration, tests, deployment documents, and examples. A second bearer credential is present in the active config.json.

Credentials committed to a distributable Skill must be considered compromised because every person or automated system that downloads the package can extract them. Documentation files do not provide protection: they are distributed with the same artifact and are searchable through ordinary text-processing tools.

The credentials authenticate requests to APIs that expose identity, positions, transaction information, investment methodology, and performance statistics. Although transmitting a user-provided credential to the declared InvestmentTracker service is necessary for the Skil ...[truncated 1298 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate both exposed credentials immediately.
2. Remove every credential occurrence from source code, tests, configuration, examples, documentation, release archives, and version-control history.
3. Replace committed values with explicit placeholders such as YOUR_API_KEY.
4. Load user-specific credentials from a protected environment variable, operating-system credential store, or deployment secret manager.
5. Do not provide a shared default credential. Fail safely or use simulated mode when no user credential is configured.
6. Use narrowly scoped, short-lived, revocable tokens where the service supports them.
7. Add automated secret scanning to commits, continuous integration, packaging, and release workflows.
8. Review service logs for unauthorized use of both exposed tokens.

T09 · Insecure Skill Coding Practices

Error

• Location: InvestmentTracker_skill.py:35

Finding

Authorization Credentials Exposed in Logs and Process Command Lines

Content

View full analysis

Vulnerability Details

File Location: InvestmentTracker_skill.py:35-36 and InvestmentTracker_skill.py:131-145; equivalent command-line credential handling occurs in final_skill.py:35-47, test_mcp_sse.py:74-87, and updated_mcp_client.py:35-45.

Vulnerability Type: Sensitive information exposure through logging and process arguments
Risk Level: High

Vulnerable Code

python

self.api_url = self.mcp_config.get("url", "")
self.headers = self.mcp_config.get("headers", {})

print(f"Configuration loaded successfully: URL={self.api_url}")
print(f"Headers: {self.headers}")

The same headers are then placed in the curl argument list:

python

# Build curl command
cmd = ['curl', '-s', '-N', '-X', 'POST']

# Add headers
for key, value in self.headers.items():
    cmd.extend(['-H', f'{key}: {value}'])

# Add request data
cmd.extend(['--data-binary', f'@{request_file}', self.api_url])

print(f"Sending request to: {self.api_url}")
print(f"Command: {' '.join(cmd[:10])}...")

try:
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,
        timeout=30
    )

Technical Analysis

self.headers includes the complete Authorization bearer value from config.json. Printing the dictionary writes that credential verbatim to standard output. In hosted or integrated environments, standard output is frequently retained by process supervisors, CI systems, container platforms, terminal capture, or centralized logging systems.

The curl-based clients also pass the authentication header as an operating-system process argument. Depending on platform configuration, process arguments may be observable through process-monitoring tools, /proc interfaces, crash diagnostics, audit systems, or command telemetry. This exposure is unnecessary because an in-process HTTP client can set headers without creating a child process containing the secret in its argu ...[truncated 1177 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the statement that prints self.headers.
2. Implement centralized log redaction for Authorization, X-API-Key, cookies, and token-like values.
3. Do not print generated commands containing headers, even partially, unless secret fields have been explicitly replaced with [REDACTED].
4. Replace curl subprocesses with an in-process client such as a carefully pinned requests, httpx, or aiohttp dependency.
5. If curl is unavoidable, supply sensitive configuration through a protected mechanism that does not expose it in the process argument vector.
6. Restrict log access and reduce retention because existing logs may already contain credentials.
7. Rotate any credential that may have appeared in logs or process-monitoring records.

T09 · Insecure Skill Coding Practices

Warning

• Location: InvestmentTracker_skill.py:120

Finding

Predictable and Insecure Temporary Request Files Permit Symlink Attacks

Content

View full analysis

Vulnerability Details

File Location: InvestmentTracker_skill.py:120-129 and InvestmentTracker_skill.py:252-257; similar patterns occur in final_skill.py:24-33, test_mcp_sse.py:63-71, fixed_skill.py:120-128, and updated_mcp_client.py:24-30.

Vulnerability Type: Unsafe temporary-file creation
Risk Level: Medium

Vulnerable Code

python

request_id = int(time.time() * 1000)
request = {
    "jsonrpc": "2.0",
    "method": method,
    "params": params or {},
    "id": request_id
}

# Save request to a temporary file
request_file = f"/tmp/mcp_request_{request_id}.json"
with open(request_file, 'w') as f:
    json.dump(request, f)

The main implementation attempts cleanup later:

python

finally:
    # Clean up temporary file
    if os.path.exists(request_file):
        os.remove(request_file)

Technical Analysis

The temporary filename is based on the current time in milliseconds and is therefore predictable within a small search window. The file is opened with ordinary write mode rather than exclusive creation. No explicit restrictive permission mode is set, and the filename is created in a shared system temporary directory.

A local attacker can pre-create a symbolic link at the predicted pathname. When the Skill opens the path with write mode, it follows the symbolic link and truncates or overwrites the linked target if the Skill's user has permission to write it. An attacker can also race the request file to alter the JSON submitted by curl.

Cleanup does not prevent exploitation because the unsafe operation occurs before cleanup. Some related implementations, including the reviewed portion of final_skill.py, do not demonstrate equivalent unconditional cleanup, increasing the possibility of residual request files.

Attack Path

1. A local attacker observes or predicts when an MCP request will be initiated.
2. The attacker calculates likely millisecond-ba ...[truncated 1082 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer sending serialized JSON to the HTTP client or curl process through standard input so no temporary file is required.
2. If a file is necessary, use tempfile.NamedTemporaryFile or tempfile.mkstemp with secure exclusive creation.
3. Ensure the file is created with permissions equivalent to mode 0600.
4. Keep the file descriptor open while it is in use where platform behavior permits.
5. Perform cleanup in a finally block in every implementation variant.
6. Do not construct temporary paths from timestamps, process IDs, request IDs, or other predictable values.
7. Consolidate the many duplicate MCP clients into one reviewed implementation to prevent insecure variants from remaining executable.

T08 · Insecure Dependencies

Warning

• Location: MCP_FIX_PLAN.md:185

Finding

Unpinned Third-Party Package Installation Guidance Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: MCP_FIX_PLAN.md:185-193

Vulnerability Type: Unpinned and insufficiently verified dependencies
Risk Level: Medium

Vulnerable Code

bash

# Option A: Use Node.js MCP SDK
npm install @modelcontextprotocol/sdk

# Option B: Use Python MCP client
pip install mcp-client

Technical Analysis

The remediation plan instructs users to install packages without exact versions, lockfiles, integrity hashes, or documented provenance. This causes package managers to resolve whichever version is current at installation time. The effective dependency code can therefore change after the Skill has been reviewed.

The Python package name is generic, and the project does not establish that it is the intended official implementation. While the audit did not prove that either named package is malicious, the installation pattern increases exposure to package compromise, dependency confusion, maintainer-account compromise, or unexpected future versions.

These commands appear as optional documentation rather than automatic runtime execution. Consequently, this finding is a supply-chain hardening issue rather than evidence that the Skill silently installs software.

Attack Path

1. A user encounters MCP compatibility problems and follows MCP_FIX_PLAN.md.
2. The user runs one of the unpinned installation commands.
3. The package manager retrieves the latest registry artifact and its transitive dependencies.
4. If the selected package or dependency has been compromised, malicious installation or runtime code executes with the installing user's privileges.
5. That code may access files, environment variables, API credentials, or network resources available to the user.

Impact Assessment

Successful exploitation would execute third-party package code with the privileges of the user performing installation or running the Skill. This could expose InvestmentTracker credentials ...[truncated 226 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify and document the official publisher, source repository, and expected package identity.
2. Pin exact package versions rather than installing unconstrained latest releases.
3. Commit lockfiles and use integrity hashes where the package ecosystem supports them.
4. Audit direct and transitive dependencies before recommending installation.
5. Use isolated virtual environments or containers and avoid privileged package installation.
6. Configure automated dependency vulnerability and provenance monitoring.
7. Remove generic or ambiguous package recommendations if their provenance cannot be verified.

T09 · Insecure Skill Coding Practices

Note

• Location: publish_script.sh:1

Finding

ClawHub Publishing Token Accepted Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: publish_script.sh:1-17 and publish_script.sh:31-38

Vulnerability Type: Sensitive token exposure through shell history and process arguments
Risk Level: Low

Vulnerable Code

bash

#!/bin/bash
# InvestmentTracker Skill publishing script
# Usage: ./publish_script.sh YOUR_CLAWHUB_TOKEN

set -e

TOKEN="$1"

# Check argument
if [ -z "$TOKEN" ]; then
    echo "Error: provide a ClawHub token"
    echo "Usage: ./publish_script.sh YOUR_CLAWHUB_TOKEN"
    exit 1
fi

The argument is subsequently exported:

bash

echo "Setting ClawHub token..."
export CLAWHUB_TOKEN="$TOKEN"

echo "Verifying ClawHub login..."
if ! clawhub whoami > /dev/null 2>&1; then
    echo "ClawHub login failed; check the token"
    exit 1
fi

Technical Analysis

Supplying a secret as the first command-line argument can expose it in interactive shell history and operating-system process metadata. Assigning it to an environment variable afterward does not remove the original argument from the shell's history or the running script's argument vector.

The publishing workflow legitimately requires a ClawHub credential, and the script does not print the token directly or install persistence. The flaw is the credential-input mechanism.

Attack Path

1. An operator follows the documented usage and runs ./publish_script.sh <token>.
2. The command, including the token, is retained in shell history or terminal telemetry.
3. Alternatively, a local user inspects the running script's process arguments.
4. The attacker obtains the ClawHub token.
5. The attacker authenticates to ClawHub and performs actions permitted by that token, potentially including unauthorized package publication.

Impact Assessment

Impact is limited to the permissions and lifetime of the exposed ClawHub token. A sufficiently privileged publishing token could permit accou ...[truncated 149 chars]

Remediation

View remediation

Remediation Suggestions

1. Read the token from an already configured protected environment variable or a secret manager.
2. If interactive input is required, use a silent prompt such as read -r -s.
3. Do not include real token values in documented command examples.
4. Clear the temporary shell variable after use where practical.
5. Use short-lived, narrowly scoped publishing credentials.
6. Rotate any token that may already have been entered through the documented command-line interface.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (174)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The deployment guide embeds what appears to be a live production API key directly in documentation and configuration examples. Publishing active credentials in a skill guide enables unauthorized access to the backend service, abuse of paid resources, and possible exposure of investment-related data if the key remains valid.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide not only exposes a live API key but presents it without any warning that it is sensitive material requiring protection. In a deployment context, this normalizes insecure secret handling and makes downstream leaks into repos, tickets, screenshots, and logs more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The troubleshooting section repeats the live production API key in a curl example, increasing the likelihood of credential reuse, copy/paste leakage, and broad exposure through documentation, shell history, and shared terminals. This materially expands the attack surface because readers are instructed to actively use the exposed secret against the production endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The curl example places a live API key directly on the command line, where it can be captured in shell history, process listings, terminal logs, and incident recordings. Because the example targets a production service, compromise of that token could allow unauthorized API use and data access beyond the local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown includes live authentication material and instructs users to send authenticated requests to an external service without any warning about secret handling or the sensitivity of investment data. In this context, the skill appears related to financial tracking, so transmitting portfolio-related requests with hardcoded credentials can lead to unauthorized account access, privacy violations, and abuse of the backend service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document exposes what appears to be a live bearer/API key directly in a summary file, enabling anyone with access to reuse the credential against the remote MCP service. In skill context this is especially dangerous because the file not only reveals the secret but also provides the exact endpoint and header format needed to authenticate, lowering the barrier to unauthorized access and possible exposure of investment or portfolio data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill prints the full headers loaded from configuration, and those headers may contain API keys, bearer tokens, or other secrets. Anyone with access to console output, logs, CI artifacts, or terminal history could recover credentials and use them to access the remote investment service or impersonate the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document embeds a live bearer token directly in client code and instructs operators to use it against a production MCP endpoint. Hardcoded production credentials in a skill or fix plan can enable unauthorized access, token reuse, data exfiltration, and lateral exposure if the document is shared, logged, or committed to source control.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Including a live bearer token in documentation without marking it as sensitive normalizes insecure secret handling and increases the likelihood that developers will embed or redistribute credentials. Even if intended as an example, the token can be harvested from docs, code review systems, backups, or model context and then used to access protected services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The plan repeatedly reuses the same bearer token across library examples, curl commands, and test code, multiplying the chance of leakage through shell history, terminal logs, copied snippets, and source repositories. Because the skill purpose is not clearly scoped and the endpoint appears to serve investment data, this creates a high risk of unauthorized access to sensitive financial information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The README embeds what appear to be live bearer/API keys directly in a sample MCP configuration. This exposes reusable credentials to anyone who can read the repository or package, enabling unauthorized access to the remote InvestmentTracker MCP endpoint and potentially any data or actions available through that account.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Including live credentials in README examples is a direct secret disclosure, not just poor documentation hygiene. Because the values are shown as ready-to-use authentication headers, users or attackers can copy them verbatim to access the service, making the skill context especially dangerous since MCP integrations commonly execute remote tool calls with those credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document embeds what appears to be a live bearer API token in curl examples, directly contradicting earlier guidance to use a placeholder or user-supplied key. If valid, anyone reading or copying the skill can reuse the credential to access remote investment endpoints, exposing account data and enabling unauthorized API consumption.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document contains what appears to be a live API key in plaintext and instructs users to send it to a remote MCP endpoint. Exposing credentials in skill documentation enables unauthorized access, reuse outside intended environments, and downstream compromise of account and portfolio data accessible through the service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation exposes a live bearer token and gives a ready-to-run authenticated request to a remote MCP endpoint. This can enable unauthorized access, abuse of the service, data exposure, or use of the skill's backing infrastructure by anyone who reads the file.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-activation keywords are broad everyday investment terms such as '投资', '持仓', '资产', and '我的投资', making accidental triggering likely during normal conversation. In a skill that can contact a remote API and access portfolio data, unintended activation increases the chance of unnecessary data access or transmission.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script embeds a live bearer token directly in source code and uses it to access a production remote MCP endpoint. Hardcoded production credentials are highly sensitive because anyone with file access can reuse the token for unauthorized API access, service abuse, or data exposure, and the debugging context increases the likelihood the token will be copied, logged, or shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The generated curl commands include the bearer token in cleartext, which can leak through terminal history, logs, screenshots, CI output, shell auditing, or copied troubleshooting notes. Because the script is specifically designed for verbose debugging, it materially increases the chance that the credential will be exposed beyond the original file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document embeds what appears to be a live bearer token directly in example curl commands for a production remote analytics service. Hardcoded credentials in public or widely accessible documentation enable unauthorized access, abuse of the API, possible exposure of portfolio analytics data, and make token rotation difficult once the file is copied or indexed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation embeds what appears to be a live bearer token directly in example commands, creating an immediate credential exposure risk. Anyone who reads, copies, or indexes this file could use the token to access portfolio data or related account functionality, and the contradiction with the later advice to store API keys securely makes the issue more concerning, not less.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The examples embed a live bearer token directly in curl commands and instruct users to make authenticated requests to a production endpoint that returns sensitive financial transaction data. This creates both credential exposure and privacy risk: anyone with access to the document can reuse the token, and users may disclose portfolio, account, and wallet information without any warning or safe-handling guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A live API key is hardcoded directly in source and then used in outbound requests. If the skill code is shared, logged, or extracted, the credential can be reused by unauthorized parties to access backend services, query sensitive investment data, or consume paid resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document includes a live-looking API key and repeats it across multiple debugging examples, which creates a clear credential exposure risk. Anyone with access to this file could reuse the key against the production Railway endpoint, potentially gaining unauthorized access, consuming resources, or extracting data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example authentication headers directly expose a live-looking API key without any warning or masking, making accidental reuse and secret leakage highly likely. Because the examples target a production URL, the context increases risk: the credential appears immediately actionable rather than purely illustrative.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains a live-looking API key in plaintext and also echoes it to stdout, making credential exposure highly likely through source control, logs, screenshots, terminal history, or copied output. Even though the script only prints commands, those commands include the secret header, so anyone with access to the file or output can reuse the key to query the remote InvestmentTracker API and potentially access sensitive financial data.

Content

No source excerpt is available for this finding.