ClawHub
Back to skill

Security audit

dcf-valuation

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent DCF valuation skill with disclosed local report generation; users should still be careful with optional cloud sync and mutable install sources.

Install from a reviewed pinned version when possible. Expect the skill to search for financial data, run a local calculator, and save Markdown reports in your workspace. Do not enable Feishu sync for confidential investment notes unless you are comfortable sending that content to a third-party cloud service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:35
Finding

Unpinned Skill Installation from Mutable Remote Sources

Content
View full analysis

Vulnerability Details

File Location: README.md:35-43 and README.md:51-53
Vulnerability Type: Supply-chain risk caused by unpinned and unverified remote installation
Risk Level: Medium

Vulnerable Code

bash
# Clone the repository
git clone https://github.com/ianzheng001/dcf-valuation-skill.git

# Copy it into the Agent skills directory
cp -r dcf-valuation-skill ~/.agents/skills/dcf

# Restart the Agent
openclaw gateway restart
bash
openclaw skills install dcf-valuation-skill

Technical Analysis

The documented installation procedures retrieve the current contents of a mutable Git repository or package registry entry without pinning an immutable commit, release version, or content digest. They also do not require verification of a cryptographic signature or checksum before installation.

The downloaded content is copied into an Agent's trusted Skill directory or installed through the Skill package manager and then activated. Consequently, the effective Skill loaded by a user may differ from the artifact reviewed during this audit.

This creates a supply-chain exposure: if the upstream repository, maintainer account, distribution package, or registry entry is compromised or maliciously updated, an attacker could replace SKILL.md, scripts/dcf_calc.py, or another distributed file. Users following the instructions would then install the altered version without an integrity check.

The artifact audited here does not itself contain a malicious payload. Exploitation depends on a malicious or compromised upstream source and a subsequent installation by a user.

Attack Path

  1. An attacker compromises the upstream repository, publisher account, or Skill registry entry.
  2. The attacker modifies the distributed Skill, such as by adding hostile Agent instructions to SKILL.md or executable behavior to scripts/dcf_calc.py.
  3. A user runs the documented unpinned git clone or openclaw skills install command.
  4. The mut ...[truncated 1019 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin Git-based installation instructions to a reviewed, immutable commit or signed release tag:
bash
git clone https://github.com/ianzheng001/dcf-valuation-skill.git
cd dcf-valuation-skill
git checkout --detach <reviewed-commit-sha>
  1. Publish a SHA-256 digest for each release artifact and require verification before installation:
bash
sha256sum -c dcf-valuation-skill.sha256

  1. Sign release tags and packaged Skill artifacts using a verifiable signing mechanism, and document signature verification as a mandatory installation step.

  2. Require an explicit immutable version when installing from the Skill registry rather than relying on the latest package:

bash
openclaw skills install dcf-valuation-skill@<reviewed-version>

  1. Ensure the registry version resolves to immutable content and provides provenance linking the package to a reviewed source commit.

  2. Review SKILL.md, executable scripts, and package manifests after download and before copying them into a trusted Agent Skill directory.

  3. Run third-party Skills with least privilege, restricting filesystem, network, credential, and tool access to capabilities required for the valuation task.

  4. Add automated release checks that compare packaged artifacts with the corresponding reviewed source commit and reject unexpected or unsigned files.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README states that results can be synchronized to Feishu cloud documents but does not clearly warn that analysis content may be transmitted to a third-party service outside the local environment. If users include proprietary investment theses, unpublished financial notes, or internal research, this omission can cause unintentional external data exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

bash
# 克隆仓库到 Claude Code 的 skills 目录
mkdir -p ~/.claude-agents/skills
cd ~/.claude-agents/skills
git clone https://github.com/ianzheng001/dcf-valuation-skill.git dcf

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill clearly instructs reading local reference files such as references/qualitative.md, but it does not declare any explicit tool scope or permissions. Undeclared file access weakens least-privilege controls and can lead to broader-than-expected local file reads if the runtime grants default filesystem capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises automatic saving of analysis results to Markdown files but does not clearly tell users where files are written, what content is stored, or that potentially sensitive financial analysis may persist locally. This can lead to unintended disclosure on shared systems or accidental retention of confidential inputs, even though the behavior is not inherently malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow directs the agent to generate and save a report into the user's local workspace and then notify the user, but it does not require explicit user confirmation before creating files. This can cause unexpected local side effects, overwrite clutter-sensitive directories, or normalize silent file creation behavior in a skill that handles user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file presents all instructions and templates exclusively in Chinese, which can force a specific language on users without opt-in. The policy for SQP-3 applies to all file types and flags language or locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring and CLI usage text are written entirely in Chinese, and the script continues this pattern in its argument descriptions and printed reports. This imposes a specific language on all users without any opt-in or documented locale justification, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.