ClawHub
Back to skill

Security audit

Trading Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed trading/status briefing tool that reads local trading state and system health, with no evidence of hidden trading actions, exfiltration, or persistence.

Install only if you want an agent-accessible trading briefing that can read local trading state, positions, PnL, logs, process status, disk, and memory. Avoid using --save unless you are comfortable storing that report in the workspace, and consider narrowing the trigger phrases if accidental disclosure during normal chat would be a problem.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises executable behavior that invokes a local Python script and static analysis detected shell and file-write capabilities, but the manifest declares no explicit tool scope or permissions. In a trading context, hidden or undeclared execution capability increases the risk of unauthorized command execution, local file modification, and access to API-key-backed trading configuration without clear user or platform controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include very broad, everyday requests such as '简报', '系统状态', and '今天市场怎么样', which can cause accidental activation during normal conversation. Because this skill accesses live trading data and potentially sensitive account/system status, unintended triggering could expose private financial information or launch privileged data collection without the user's explicit intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that the skill reuses API keys from live_trading/config.json and accesses positions, PnL, bot status, and system health, but it does not clearly warn users that live account and host-level operational data will be accessed. This lack of disclosure is dangerous because users may invoke the skill without understanding that sensitive financial and infrastructure information is being queried and potentially surfaced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The module docstring and all user-facing report labels are written in Chinese, indicating the skill is designed to communicate in a fixed language. The file does not provide any opt-in, locale selection, or justification for restricting output to Chinese, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/briefing.py (reported line 66)May include surrounding context.

python
# 检查进程
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'bot.py'],
            capture_output=True, text=True, timeout=5
        )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

Beyond summarizing trading information, the code invokes host utilities such as pgrep, tail, df, and free to inspect processes, logs, disk, and memory. While some health checking is declared, direct subprocess execution is a privileged implementation capability that is not explicitly justified or disclosed by the manifest.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
79% confidence
Finding

The code passes log_file into an external tail command after only checking os.path.exists(). If an attacker can replace that path with a symlink or point it at an arbitrary file within the accessible filesystem, the skill may disclose unintended local file content in the generated report, creating an information exposure issue.

Content

Scanner excerpt · scripts/briefing.py (reported line 91)May include surrounding context.

python
# 获取最后交易时间
    if os.path.exists(log_file):
        try:
            result = subprocess.run(
                ['tail', '-20', log_file],
                capture_output=True, text=True, timeout=5
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/briefing.py (reported line 124)May include surrounding context.

python
# 磁盘
    try:
        result = subprocess.run(['df', '-h', '/'], capture_output=True, text=True, timeout=5)
        lines = result.stdout.strip().split('\n')
        if len(lines) > 1:
            parts = lines[1].split()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/briefing.py (reported line 135)May include surrounding context.

python
# 内存
    try:
        result = subprocess.run(['free', '-h'], capture_output=True, text=True, timeout=5)
        lines = result.stdout.strip().split('\n')
        if len(lines) > 1:
            parts = lines[1].split()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/briefing.py (reported line 154)May include surrounding context.

python
health['processes'] = {}
    for proc, name in processes.items():
        try:
            result = subprocess.run(
                ['pgrep', '-f', proc],
                capture_output=True, text=True, timeout=5
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/briefing.py (reported line 178)May include surrounding context.

python
# 检查进程
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'strategy_discovery.py'],
            capture_output=True, text=True, timeout=5
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is described as a briefing generator, but with --save it writes a report file into the workspace containing trading state, positions, PnL, and system details. Persisting this sensitive operational data expands exposure through later access by other tools, users, or skills, especially in a shared workspace context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest and instructions are written as Chinese-only user-facing text and the trigger examples are primarily Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes market aggregation as covering 'BTC/ETH主流币价格', which implies a narrower scope than the implementation. The code expands the briefing to additional assets ('SOL/USDT' and 'BNB/USDT'), so the actual behavior exceeds the specifically stated market-data scope.

Content

No source excerpt is available for this finding.