ClawHub
Back to skill

Security audit

Edgar Risk Diff

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed SEC filing research helper that fetches public EDGAR data, caches it locally, and gates one optional premium feature with a local license key.

Install only if you are comfortable with the skill making HTTPS GET requests to SEC EDGAR, sending your configured EDGAR User-Agent to those SEC servers, and storing downloaded public filings in ~/.edgar-risk-diff/cache. If you buy the premium feature, keep the license key out of shared repositories and shell history where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'EDGAR_HEADERS' from os.environ.get (line 37, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
def _http_get(url: str) -> bytes:
    _throttle()
    r = requests.get(url, headers=EDGAR_HEADERS, timeout=30)
    r.raise_for_status()
    return r.content
Confidence
90% confidence
Finding
r = requests.get(url, headers=EDGAR_HEADERS, timeout=30)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
This is a mismatch because the core described behavior is largely accurate, but the code exposes additional end-user capabilities beyond the declared purpose. In particular, `latest` retrieves and prints the full latest Item 1A section, and `scan` summarizes changes across multiple tickers; neither capability is disclosed in the description. The premium novelty feature is also not truly embedding-based in the conventional sense—it uses a local hashed bigram vector approximation rather than external embeddings—though it is still a novelty-scoring feature. The code uses SEC EDGAR directly and does not require an API key, which matches the description, and there are no suspicious unrelated resources or triggers. Still, the undeclared commands constitute hidden functionality under the evaluation criteria.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The manifest and CLI/docs describe the premium feature as 'embedding-based novelty scoring,' which implies semantic embeddings. However, the implementation computes a deterministic hashed bag-of-bigrams vector in `_hash_vec` and cosine similarity over those vectors, which is a much simpler lexical approximation rather than an embedding-based method. This is an active documentation-to-code contradiction, not just an omitted detail.

Missing User Warnings

Low
Confidence
90% confidence
Finding
This code persists remote filing contents to ~/.edgar-risk-diff/cache via p.write_bytes(value), which is a file-write operation. Although the module docstring mentions the cache location, there is no runtime notice, confirmation, or nearby comment/docstring on the write itself warning that filing data will be stored locally.

External Transmission

Medium
Category
Data Exfiltration
Content
def list_10k_filings(cik: str, limit: int = 8) -> list[Filing]:
    url = f"https://data.sec.gov/submissions/CIK{cik}.json"
    sub = json.loads(_cached_get(url))
    recent = sub["filings"]["recent"]
    out: list[Filing] = []
Confidence
60% confidence
Finding
https://data.sec.gov/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.