T08 · Insecure Dependencies
Warning
- Location
scripts/get_stock_info.py:18- Finding
Execution of an Unverified External Workspace Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Stock Tracker Pro
Security checks for vulnerabilities and agentic risk
Overview
This stock-tracking skill is mostly purpose-aligned, but it runs an unverified external script from another local skill to fetch news.
Review before installing. The stock watchlist behavior is straightforward, but stock lookups can contact Yahoo Finance and invoke a separate Tavily search script outside this package. Install only if you trust that other local skill path and are comfortable with stock symbols/company names being sent to external services.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared behavior does not fully match the observed capabilities: the skill reportedly invokes external news search functionality via another script/subprocess that is not clearly disclosed in the primary description. Hidden or under-disclosed networked behavior is dangerous because it can expose user queries to third parties and expand the attack surface beyond simple stock lookup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared behavior does not fully match the observed capabilities: the skill reportedly invokes external news search functionality via another script/subprocess that is not clearly disclosed in the primary description. Hidden or under-disclosed networked behavior is dangerous because it can expose user queries to third parties and expand the attack surface beyond simple stock lookup.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Executing an external Python script from a hard-coded path is a significant trust and supply-chain risk, especially when that script is outside the current skill. A compromised workspace, swapped helper script, or malicious update to the referenced skill would let an attacker execute arbitrary code whenever stock info is requested.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises shell, file read/write, and network-capable operations but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance the skill can invoke broader capabilities than users or reviewers expect, especially since it persists data locally and fetches remote content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill manifest and examples are entirely in Chinese and describe the skill as operating in Chinese without any indication that other languages are supported or that the user can choose a locale. This creates a language-policy concern because the skill appears to impose a specific language by default rather than offering opt-in or choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Overly broad trigger phrases can cause the skill to activate on ordinary conversation and perform unintended actions such as network requests or local file modifications. In this skill's context, accidental activation is more concerning because it can write to a persistent watchlist and fetch external content without a narrowly scoped command.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata says it uses Yahoo Finance for stock data, but the implementation also sends company and ticker queries to a separate Tavily search script. This undisclosed data flow increases external exposure and violates least surprise; users and reviewers may believe only Yahoo Finance is contacted when an additional service is used.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 81% confidence
- Finding
The code launches an external Python script via subprocess from an absolute workspace path. Although arguments are passed as a list rather than a shell string, this still expands the trust boundary: the skill executes code outside this file, and if that referenced script is modified, replaced, or untrusted, this skill will run it with the current agent's permissions.
- Content
python # Try to find tavily script in workspace tavily_script = "/home/frank/.openclaw/workspace/skills/openclaw-tavily-search/scripts/tavily_search.py" result = subprocess.run( ["python3", tavily_script, "--query", query, "--max-results", "3", "--format", "brave"], capture_output=True, text=True,
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script emits user-facing status and error messages in Chinese, and this pattern continues throughout the file. This imposes a specific language/locale on users without offering a language choice or documenting a justified locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple user-facing strings, including errors, usage text, and status messages, are hard-coded in Chinese. For a general-purpose stock manager, this imposes a specific language without user opt-in, which matches the language/locale policy violation criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description omits a clear warning that stock queries may fetch external data and display third-party news content. This matters because users may not realize their queries are being sent to external services or that returned news could contain untrusted or manipulative content.
- Content
Static analysis
No suspicious patterns detected.