jun-invest-option-master-installer (DEPRECATED)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:58 AM UTC
• Version: 0.99.0

Overview

This deprecated installer contains powerful update, install, and agent-registration workflows that can change local agent state without clear approval gates.

Review this package carefully before installing. It should not be used in an environment where an agent may run update/install commands automatically; require explicit approval for package updates, script execution, destination paths, and agent registration, and use only a local trusted Futu OpenD endpoint unless transport security is fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: agent/AGENTS.md:21
• Finding: Automatic Retrieval and Execution of an Unpinned Remote Installer<![CDATA[ ## Vulnerability Details **File Location**: `agent/AGENTS.md:21-30` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: Critical ### Evidence ```text 1. clawhub update jun-invest-option-master-installer --force 2. Run the downloaded installer's scripts/install.sh to synchronize assets. 3. openclaw agents add jun-invest-option-master --non-interactive --workspace /Users/lijunsheng/.openclaw/workspace-jun-invest-option-master ``` The same behavior is reinforced by `agent/SOUL.md:9-12`, which directs the agent to execute the standard update process immediately when a user makes a generic update request, without first clarifying the requested operation. ### Technical Analysis The instructions reinterpret broad phrases such as “update to latest” as authorization to forcibly retrieve the latest version of a remote ClawHub package and run its installer. The retrieved artifact is not pinned to an immutable version or cryptographic digest, and no signature, checksum, provenance, or post-download review is required. Consequently, the effective code executed by the agent can change after this version of the skill has been reviewed. The remote registry account, distribution infrastructure, or package itself becomes part of the trusted execution boundary. The `--force` option further weakens local safeguards by replacing the installed artifact. Automatically running the newly retrieved `scripts/install.sh` converts a supply-chain compromise directly into local code execution. ### Attack Path 1. An attacker compromises the publisher account, registry entry, or package delivery infrastructure. 2. The attacker publishes a modified “latest” installer containing malicious scripts or agent instructions. 3. A user makes a generic request such as “update to latest.” 4. The loaded instructions direct the agent not to clarify the request. 5. The agent runs `clawhub update ... --force`, retrieving the attacker-controlled package. ...[truncated 672 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic execution of update operations triggered by ambiguous phrases. 2. Require explicit, informed confirmation that identifies the exact package, version, source, and installation target. 3. Pin the package to an immutable version and verified cryptographic digest. 4. Verify a trusted publisher signature and package provenance before installation. 5. Download updates into an isolated staging directory and inspect the manifest and executable files before running them. 6. Display the proposed file changes and commands to the user before execution. 7. Run installers in a sandbox with restricted filesystem and network access. 8. Do not use `--force` unless the user separately authorizes replacement after reviewing the consequences. ]]>

T06 · System Persistence

Error

• Location: agent/AGENTS.md:21
• Finding: Non-Interactive Registration of a Remotely Updated Agent Workspace<![CDATA[ ## Vulnerability Details **File Location**: `agent/AGENTS.md:21-28` **Vulnerability Type**: Persistent agent registration **Risk Level**: High ### Evidence ```text clawhub update jun-invest-option-master-installer --force openclaw agents add jun-invest-option-master --non-interactive --workspace /Users/lijunsheng/.openclaw/workspace-jun-invest-option-master ``` ### Technical Analysis After retrieving and installing mutable remote content, the workflow registers the resulting workspace as an OpenClaw agent using `--non-interactive`. Registration is not separated from package installation and does not require the user to inspect the installed instructions or approve their continued availability. This creates a persistence boundary: content obtained during one update can remain registered for later agent invocations. The risk is compounded by the unpinned remote update process because a supply-chain attacker can modify both executable files and instruction files before registration. This finding does not establish an operating-system startup service or scheduled task. The persistence is specifically at the OpenClaw agent-registration level. ### Attack Path 1. A malicious or compromised remote update is downloaded. 2. The installer places modified instructions and code in the configured workspace. 3. The workflow invokes `openclaw agents add` with `--non-interactive`. 4. The modified workspace is registered without a separate review or approval step. 5. The altered agent remains available in subsequent OpenClaw sessions until it is explicitly removed or replaced. ### Impact Assessment The attacker can preserve malicious agent instructions and tools across subsequent sessions within the OpenClaw environment. Depending on the permissions later granted to the registered agent, this can enable repeated access to workspace files, available tools, environment data, and reachable network resources. Automatic agent registration is not necessary for th ...[truncated 119 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate package installation from agent registration. 2. Require explicit confirmation immediately before registration. 3. Present the resolved workspace path, package version, digest, publisher identity, and requested capabilities. 4. Remove `--non-interactive` from the default workflow. 5. Verify the complete workspace contents before registration. 6. Apply least-privilege tool and network policies to the registered agent. 7. Document and expose an explicit rollback and unregister procedure. 8. Record an audit event containing the approved artifact identity and registration result. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:49
• Finding: Workspace Path Traversal and Destructive Destination Replacement<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:49-65` **Vulnerability Type**: Unvalidated filesystem destination **Risk Level**: High ### Evidence ```bash if [[ -z "${TARGET_DIR_NAME}" ]]; then DST_DIR="${WORKSPACE}" else DST_DIR="${WORKSPACE}/${TARGET_DIR_NAME}" fi mkdir -p "${WORKSPACE}" if [[ -e "${DST_DIR}" ]]; then TS=$(date +"%Y%m%d-%H%M%S") BACKUP="${DST_DIR}.bak.${TS}" echo "Target exists; backing up to: ${BACKUP}" mv "${DST_DIR}" "${BACKUP}" fi mkdir -p "${DST_DIR}" ``` The destination is subsequently populated with: ```bash rsync -a "${SRC_DIR}/" "${DST_DIR}/" ``` ### Technical Analysis Both `WORKSPACE` and `TARGET_DIR_NAME` originate from command-line arguments, but the installer does not canonicalize them or verify that the resolved destination remains inside an approved workspace root. A target name containing parent-directory components, such as `../victim`, produces a path that resolves outside the intended workspace. If the resolved target already exists, the script moves the entire target to a timestamped backup before creating a replacement and copying agent files into it. There is also a destructive logic issue when `--target-name` is omitted: 1. `DST_DIR` is set equal to `WORKSPACE`. 2. `mkdir -p "${WORKSPACE}"` ensures that the destination exists. 3. The existence check therefore succeeds. 4. The entire workspace is moved to a backup before a new workspace is created. The backup may permit recovery, but the operation can unexpectedly relocate unrelated workspace contents and interrupt applications relying on the original path. ### Attack Path 1. An attacker or unsafe automation controls installer arguments. 2. It invokes the installer with a traversal value, for example: ```text --workspace /approved/workspace --target-name ../victim ``` 3. `DST_DIR` resolves to `/approved/victim`, outside `/approved/workspace`. 4. If that destination exists, it is moved to a timestamped backup ...[truncated 798 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve `WORKSPACE` and `DST_DIR` to canonical absolute paths before performing filesystem operations. 2. Reject `TARGET_DIR_NAME` values that are empty when a subdirectory is required, absolute, equal to `.` or `..`, or contain parent-directory traversal components. 3. Verify that the canonical destination starts with the canonical approved workspace root followed by a path separator. 4. Do not create the workspace before determining whether an existing destination needs backup. 5. When installing directly into an existing workspace, back up only files that the installer owns rather than moving the entire workspace. 6. Refuse to replace a nonempty destination unless the user explicitly confirms the resolved path. 7. Use a staging directory and atomically replace only the managed agent directory after validation succeeds. 8. Add tests covering `..`, symbolic links, missing target names, existing workspaces, and destinations outside the approved root. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: agent/invest_agent/integrations/futu/futu_adapter.py:32
• Finding: Broker API Transport Encryption Explicitly Disabled for Configurable Hosts<![CDATA[ ## Vulnerability Details **File Location**: `agent/invest_agent/integrations/futu/futu_adapter.py:32-47` **Vulnerability Type**: Plaintext broker API transport **Risk Level**: Medium ### Evidence ```python class FutuAdapter: def __init__(self, host: str, port: int, market: str = "US") -> None: self.host = host self.port = int(port) self.market = (market or "US").upper() self._quote_ctx = None def _ensure_ctx(self) -> None: if self._quote_ctx is not None: return if OpenQuoteContext is None: raise RuntimeError( "futu-api is not installed. Install with: pip install futu-api" ) from _FUTU_IMPORT_ERROR try: self._quote_ctx = OpenQuoteContext(host=self.host, port=self.port, is_encrypt=False) except TypeError: self._quote_ctx = OpenQuoteContext(host=self.host, port=self.port) ``` The host is configurable in `agent/invest_agent/integrations/futu/futu_adapter.py:382-389`: ```python def load_from_env() -> "FutuAdapter": host = os.getenv("FUTU_OPEND_HOST", "127.0.0.1") port = int(os.getenv("FUTU_OPEND_PORT", "11111")) market = os.getenv("FUTU_MARKET", "US") return FutuAdapter(host=host, port=port, market=market) ``` ### Technical Analysis The adapter explicitly passes `is_encrypt=False` while allowing the OpenD host to be supplied through an environment variable. The default loopback host reduces exposure in the default configuration, but the associated documentation anticipates both local and remote gateway locations. When a non-loopback endpoint is configured, quote requests, requested ticker and option symbols, health information, and returned broker market data may cross an untrusted network without application-level transport encryption. A fallback constructor is also used without confirming whether encryption is enabled by default. The reviewed adapter uses `OpenQuoteContext` and conta ...[truncated 1352 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit `is_encrypt=False` only when the resolved destination is a verified loopback address. 2. Reject remote hosts unless encrypted OpenD transport or a verified secure tunnel is configured. 3. Make encryption the default and require an explicit, narrowly scoped opt-out for local development. 4. Verify server identity rather than relying only on connection encryption. 5. Document that remote plaintext OpenD endpoints are unsupported. 6. Avoid silently falling back to a constructor whose encryption behavior is unknown; fail closed when the required secure option is unavailable. 7. Add tests confirming that non-loopback IPv4 and IPv6 destinations cannot be used in plaintext mode. 8. Redact broker server details from logs and returned error messages where they are not operationally necessary. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A package presented as deprecated but capable of installing files, creating backups, modifying directories, and invoking external tooling is highly dangerous because it can change the local environment while evading scrutiny. In this context, concealed installer behavior materially increases the risk of unauthorized filesystem modification and supply-chain style abuse.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The default workflow states that a feature request should lead to repository modification, git commit, publishing a new installer version, and automatic deployment, without warning the user that this is a release-and-deploy pipeline. That creates a serious integrity and supply-chain risk because ordinary conversational requests can be escalated into persistent code changes and distribution events.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says the skill is a deprecated installer and points users to another agent, but this code reads multiple investment-analysis JSON artifacts, fills an approval packet template, and writes a completed markdown report. That behavior is semantically unrelated to an installer and indicates the implemented functionality diverges from the skill's declared purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The visible user-facing instructions are entirely in Chinese ('此 skill 已废弃。请改用...') with no alternative language or opt-in, which can violate language/locale policy requirements. Nothing in the file indicates that the skill is region-specific or that the user can choose the language.

Natural-Language Policy Violations

Medium

• Confidence: 78% confidence
• Finding: The operational instructions and trigger phrases are defined entirely in Chinese, and the file does not indicate that users may choose another language or that the locale is intentionally restricted for a documented regional purpose. This can constitute a language/locale policy issue when a skill effectively forces one language without opt-in.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad and designed to cause automatic execution from short natural-language prompts, with only a limited exclusion about not upgrading the OpenClaw core. This increases the chance of ambiguous or accidental activation of privileged update actions, especially when the commands include forceful update behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documented behavior goes well beyond a passive deprecated reference: it performs forced package updates, runs an installer script, modifies a local workspace, and registers an agent. In a deprecated installer, this creates hidden operational authority and can mislead users into invoking impactful system changes under a narrow or outdated description.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions direct the agent to perform local system modifications automatically, including forced updates, running a shell installer, synchronizing files into a user workspace, and registering the agent, without an explicit warning or consent checkpoint. This is dangerous because it normalizes silent execution of privileged and state-changing operations from a conversational trigger.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes a default workflow to modify code, commit it, publish a new installer version, and immediately deploy it, which materially expands its authority beyond a simple installer. That creates a supply-chain risk: a user request framed as a feature change could trigger code publication and propagation without a separate approval boundary.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The entire skill documentation is presented in Chinese and names a specific approver (`生哥`) without indicating that language is configurable or optional. Under the policy criteria, forcing a specific language or locale without user opt-in can constitute a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The instruction specifies the skill's style in Chinese and directs a fixed communication mode without indicating that users may choose another language or locale. This can violate language/locale policy when the skill is used in broader contexts where user language preference is not explicitly collected.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This manifest file contains a natural-language note in Chinese at L13, while the rest of the file is in English. That creates a language/locale policy concern because the skill content implicitly forces a specific language for part of the policy without user opt-in or an explicit region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file presents the skill plan and operating instructions entirely in Chinese, beginning with the title and continuing through most procedural content. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The title and stated goal are written as fixed Chinese instructions, and the file does not indicate that language is selectable by the user. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README is written entirely in Chinese and includes user-facing trigger and usage instructions only in Chinese, with no indication that another language is supported or that Chinese is a justified locale constraint. Under the policy rule for language/locale, this is a natural-language policy concern because the skill effectively imposes a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The note at L13 is written in Chinese while the rest of the policy file is in English-like identifiers, which can impose a specific language on readers or operators without opt-in. The stated policy requires flagging language or locale constraints when no user choice or justification is provided.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The top-level documentation explicitly limits the adapter to quotes and health checks, and notes no order placement. However, the class implements get_options_chain_summary, which fetches option chains, market snapshots for options, and computes derivatives analytics like ATM IV and put skew. This is an active contradiction in documented scope, not merely missing detail.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file-level description states the adapter is for "quotes + healthcheck only," which implies a narrow market-data role. The implemented get_options_chain_summary method goes beyond that by accessing option contract chains and computing analytics such as ATM implied volatility, bid/ask spread summaries, and put skew. That behavior exceeds the stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: When broker spot data is unavailable, the adapter silently falls back to a public yfinance integration, introducing an undocumented external network dependency and data-source change. In security-sensitive or regulated environments, this can bypass expected egress restrictions, leak user interest in specific tickers to a third party, and violate trust assumptions that this adapter is Futu-only.

Static analysis

No suspicious patterns detected.