ClawHub
Back to skill

Security audit

Trading Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed trading/status briefing tool that reads local trading state and system health, with no evidence of hidden trading actions, exfiltration, or persistence.

Install only if you want an agent-accessible trading briefing that can read local trading state, positions, PnL, logs, process status, disk, and memory. Avoid using --save unless you are comfortable storing that report in the workspace, and consider narrowing the trigger phrases if accidental disclosure during normal chat would be a problem.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises executable behavior that invokes a local Python script and static analysis detected shell and file-write capabilities, but the manifest declares no explicit tool scope or permissions. In a trading context, hidden or undeclared execution capability increases the risk of unauthorized command execution, local file modification, and access to API-key-backed trading configuration without clear user or platform controls.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases include very broad, everyday requests such as '简报', '系统状态', and '今天市场怎么样', which can cause accidental activation during normal conversation. Because this skill accesses live trading data and potentially sensitive account/system status, unintended triggering could expose private financial information or launch privileged data collection without the user's explicit intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation states that the skill reuses API keys from live_trading/config.json and accesses positions, PnL, bot status, and system health, but it does not clearly warn users that live account and host-level operational data will be accessed. This lack of disclosure is dangerous because users may invoke the skill without understanding that sensitive financial and infrastructure information is being queried and potentially surfaced.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The module docstring and all user-facing report labels are written in Chinese, indicating the skill is designed to communicate in a fixed language. The file does not provide any opt-in, locale selection, or justification for restricting output to Chinese, which can violate language/locale policy requirements.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 检查进程
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'bot.py'],
            capture_output=True, text=True, timeout=5
        )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
Beyond summarizing trading information, the code invokes host utilities such as `pgrep`, `tail`, `df`, and `free` to inspect processes, logs, disk, and memory. While some health checking is declared, direct subprocess execution is a privileged implementation capability that is not explicitly justified or disclosed by the manifest.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 获取最后交易时间
    if os.path.exists(log_file):
        try:
            result = subprocess.run(
                ['tail', '-20', log_file],
                capture_output=True, text=True, timeout=5
            )
Confidence
79% confidence
Finding
The code passes `log_file` into an external `tail` command after only checking `os.path.exists()`. If an attacker can replace that path with a symlink or point it at an arbitrary file within the accessible filesystem, the skill may disclose unintended local file content in the generated report, creating an information exposure issue.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 磁盘
    try:
        result = subprocess.run(['df', '-h', '/'], capture_output=True, text=True, timeout=5)
        lines = result.stdout.strip().split('\n')
        if len(lines) > 1:
            parts = lines[1].split()
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 内存
    try:
        result = subprocess.run(['free', '-h'], capture_output=True, text=True, timeout=5)
        lines = result.stdout.strip().split('\n')
        if len(lines) > 1:
            parts = lines[1].split()
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
health['processes'] = {}
    for proc, name in processes.items():
        try:
            result = subprocess.run(
                ['pgrep', '-f', proc],
                capture_output=True, text=True, timeout=5
            )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 检查进程
    try:
        result = subprocess.run(
            ['pgrep', '-f', 'strategy_discovery.py'],
            capture_output=True, text=True, timeout=5
        )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill is described as a briefing generator, but with `--save` it writes a report file into the workspace containing trading state, positions, PnL, and system details. Persisting this sensitive operational data expands exposure through later access by other tools, users, or skills, especially in a shared workspace context.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The manifest and instructions are written as Chinese-only user-facing text and the trigger examples are primarily Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or justification.

Description-Behavior Mismatch

Low
Confidence
94% confidence
Finding
The manifest describes market aggregation as covering 'BTC/ETH主流币价格', which implies a narrower scope than the implementation. The code expands the briefing to additional assets ('SOL/USDT' and 'BNB/USDT'), so the actual behavior exceeds the specifically stated market-data scope.

Static analysis

No suspicious patterns detected.