ClawHub
Back to skill

Security audit

Zerodha

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Zerodha CLI command router, but it gives unsafe install commands and handles trading credentials in a way users should review carefully.

Before installing, review the installer source and prefer a pinned release with checksum or signature verification instead of piping GitHub content directly into a shell. Do not paste Zerodha API secrets into ordinary chat or run commands that expose secrets in shell history; use a safer credential prompt or rotate credentials if they were exposed. Treat generated order, cancel, exit, revoke, delete, and SIP/MF commands as live financial actions and confirm them manually before running.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:20
Finding

Unpinned Remote Installer Downloaded and Executed Without Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:68
Finding

API Secrets Exposed Through Generated Command-Line Arguments

Content
View full analysis
--api-key --api-secret --set-active` 5. If user explicitly wants to update only one credential on an existing profile, emit: - `zerodha config profile set-api-key --api-key ` - `zerodha config profile set-api-secret --api-secret ` ``` The command catalog reinforces the same behavior: ```text - `zerodha config profile add --api-key --api-secret [--set-active]` - Constraints: `` required; `--api-key` and `--api-secret` required. - `zerodha config profile set-api-key --api-key ` - Constraints: ``, `--api-key` required. - `zerodha config profile set-api-secret --api-secret ` - Constraints: ``, `--api-secret` required. ``` ### Technical Analysis The login procedure instructs the Agent to collect API credentials across messages, retain them during the login task, and interpolate them into an exact runnable command. This places the API secret in both the conversational response and the operating-system command line. Secrets provided this way may be retained in chat history, Agent telemetry, terminal scrollback, shell history, process-monitoring output, audit logs, clipboard history, or command-recording systems. Depending on the operating system and process configuration, command-line arguments may also be observable by other local processes or users while the command runs. Although configuring credentials is necessary for authentication, reproducing secret values in an Agent-generated command is not the minimum safe mechanism. An interactive hidden prompt, standard input, o ...[truncated 1541 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
- If no profile is selected, use:
     `zerodha config profile use <name>`
5. Auth/session:
   - API data/order commands require an access token.
   - If missing, run `zerodha auth login ...`.
   - CLI auto-refreshes access token when refresh token exists.
6. Never guess missing required fields for write actions; ask for the missing values.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
- If no profile is selected, use:
     `zerodha config profile use <name>`
5. Auth/session:
   - API data/order commands require an access token.
   - If missing, run `zerodha auth login ...`.
   - CLI auto-refreshes access token when refresh token exists.
6. Never guess missing required fields for write actions; ask for the missing values.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
- If no profile is selected, use:
     `zerodha config profile use <name>`
5. Auth/session:
   - API data/order commands require an access token.
   - If missing, run `zerodha auth login ...`.
   - CLI auto-refreshes access token when refresh token exists.
6. Never guess missing required fields for write actions; ask for the missing values.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs downstream agents to install the CLI by piping remote scripts from GitHub directly into a shell (sh/iex). This creates a supply-chain and arbitrary code execution risk because any compromise of the repository, network path, or referenced script causes immediate code execution on the user's machine without verification or warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The login flow directs users to pass sensitive values such as api_key, api_secret, and request tokens on the command line. Secrets supplied as CLI arguments can be exposed through shell history, process listings, terminal logging, or agent telemetry, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill description includes irreversible or impactful operations such as removing profiles, logging out, revoking refresh tokens, cancelling orders, exiting orders, and deleting GTT triggers. The markdown does not warn users that these actions can disrupt access or trading state, despite affecting account and order integrity.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The command curl ... | sh fetches a script from an external source and immediately executes it. This is dangerous because it trusts remote content at runtime without integrity verification, allowing arbitrary code execution if the source is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
Install commands:

- Linux/macOS (`curl`): `curl -fsSL https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.sh | sh`
- Linux/macOS (`wget`): `wget -qO- https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.sh | sh`
- Windows PowerShell: `irm https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.ps1 | iex`
- Windows CMD: `powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.ps1 | iex"`

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The wget -qO- ... | sh pattern has the same arbitrary code execution and supply-chain exposure as curl | sh. It silently downloads remote content and pipes it to a shell without validation, making compromise of the upstream source immediately impactful.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
Install commands:

- Linux/macOS (`curl`): `curl -fsSL https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.sh | sh`
- Linux/macOS (`wget`): `wget -qO- https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.sh | sh`
- Windows PowerShell: `irm https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.ps1 | iex`
- Windows CMD: `powershell -NoProfile -ExecutionPolicy Bypass -Command "irm https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.ps1 | iex"`

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The intent defaults repeat unsafe installer behavior by routing generic install requests to remote script execution commands. Because this is a default path, the skill increases the likelihood that downstream agents will suggest unsafe one-liners broadly and automatically.

Content

Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.

md
# Intent to Command Defaults

- If user asks generic "install zerodha cli":
  - Linux/macOS: `curl -fsSL https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.sh | sh`
  - Windows: `irm https://raw.githubusercontent.com/jatinbansal1998/zerodha-kite-cli/main/scripts/install.ps1 | iex`
- If user asks generic "login" and no auth fields are provided:
  - ask for `api_key` and `api_secret` first (profile defaults to `default` unless specified)

Static analysis

No suspicious patterns detected.