ClawHub
Back to skill

Security audit

Daily Market Report

Security checks for vulnerabilities and agentic risk

Overview

This market-report skill mostly does stock-reporting work, but its setup and bundled scripts include unsafe remote execution, automatic package installation, and an exposed undocumented API key.

Review before installing. Use a pinned, trusted installation method instead of the remote shell/PowerShell commands, do not run the bundled Finnhub script with the exposed key, and prefer installing reviewed dependencies in an isolated environment before running the report script.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:47
Finding

Unverified Remote Shell Installer Execution

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:52
Finding

Remote PowerShell Execution with Execution Policy Bypass

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch_data.py:1
Finding

Hardcoded Finnhub API Credential in Source Code

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/get_market_data.py:18
Finding

Automatic Installation of an Unpinned Dependency at Runtime

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code only retrieves and prints quote/basic financial data for preset symbols and market ETFs. While it overlaps with parts of the description (52-week range and analyst ratings), it materially differs from the declared implementation and purpose: it uses Finnhub rather than Yahoo Finance/yfinance, includes a hardcoded API key despite no declared permissions, does not calculate portfolio P&L, does not tailor output to arbitrary user holdings, and does not produce actionable suggestions or a full daily analysis report.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code generally aligns with the stated domain and data source: it uses yfinance to produce a daily US stock report with 52-week range, analyst-related data, and suggestions. However, the declared description implies a report for user holdings in general and includes portfolio P&L, while the implementation is narrowly scoped to two predefined symbols with fixed cost bases and no share counts, preventing actual portfolio-wide P&L calculation. The report is therefore materially more limited than described, though it does not perform any unrelated or risky undeclared actions.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network content straight into a shell removes the user's opportunity to inspect what will run and creates an immediate remote-code-execution path if the fetched content is tampered with. In a skill document, this is especially risky because users may copy-paste the command verbatim, extending trust from the skill author to a third-party endpoint.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

macOS / Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows (PowerShell):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script embeds a live Finnhub API key directly in source code while the skill metadata claims to use Yahoo Finance/yfinance with no API key required. Hardcoded secrets are easily exposed to users, downstream logs, repositories, or package consumers, enabling unauthorized use of the account and indicating the implementation is materially different from what operators and users would expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hardcoded API credential in distributed code is a direct secret exposure. Anyone who can read the file can reuse the key to consume quota, incur cost, access vendor-linked data under the author's account, or cause service suspension; in this skill context the danger is increased because the manifest explicitly suggests no API key is needed, reducing the chance that users scrutinize secret handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest claims generation of daily analysis reports for user holdings including portfolio P&L, 52-week range, analyst ratings, and actionable suggestions. This code prints index snapshots plus per-symbol quote, 52-week, market cap, beta, EPS, and analyst counts for two hardcoded holdings, but contains no portfolio P&L calculation, no user-specific holdings input, and no suggestion/report-generation logic.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code automatically installs a dependency at runtime, which is not required to fulfill the business purpose of generating a stock report. This behavior can trigger network access and execution of unreviewed installation-time code, making the skill materially riskier in restricted or production environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The script executes pip in a subprocess at runtime when yfinance is missing. Installing packages during execution expands the trust boundary to package indexes, mirrors, and the local Python environment, which is unnecessary for a market-reporting skill and can lead to supply-chain abuse or unexpected code execution via package install hooks.

Content

Scanner excerpt · scripts/get_market_data.py (reported line 22)May include surrounding context.

python
except ImportError:
    print("Installing yfinance...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
    import yfinance as yf

# 用户持仓：只有 BMI 和 PDD

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The documentation instructs users to fetch and execute a remote install script directly from the internet. If the remote host, transport path, or published script is ever compromised, users could execute arbitrary code on their machine with their current privileges.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

macOS / Linux:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Windows (PowerShell):

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring is written in Chinese and presents the skill's purpose and scope in a fixed language. The policy requires flagging language or locale constraints when the skill does not offer user opt-in or language choice, and no such choice is documented here.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/fetch_data.py:4