ClawHub
Back to skill

Security audit

Gold Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent gold-price tracking and alerting tool, with expected local files, public data fetching, and configurable notifications.

Install only if you want a Chinese-language gold monitoring workflow that writes local state and can be scheduled. Review config.yaml before enabling email, webhook, or custom notifier commands, because notifier processes run locally and may inherit sensitive environment variables.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
success_marker = notifier.get("success_marker", "") or ""

    try:
        proc = subprocess.run(
            argv,
            input=message if use_stdin else None,
            text=True,
Confidence
92% confidence
Finding
This code executes a notifier command taken from configuration and passes message content directly into that process via stdin or argument substitution. Although it does not use shell=True, it still creates a dangerous command-execution boundary where a modified config or malicious notifier script can exfiltrate secrets or run arbitrary code under the agent's privileges.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The skill documentation is entirely in Chinese and defines required output behavior without offering any mechanism to adapt to the user's preferred language. This can cause misleading or unusable outputs for users who do not understand Chinese, increasing the risk of operator error and making the agent less reliable in multilingual contexts.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The child process inherits the full parent environment and also receives additional configured variables. If notifier commands are external or attacker-controlled, this can expose sensitive tokens, credentials, or internal configuration values to those subprocesses without minimization.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
return False, "", "notifier 缺少 command"

    use_stdin = bool(notifier.get("stdin", True))
    env = os.environ.copy()
    env["SKILL_ROOT"] = str(paths.ROOT)
    for k, v in (notifier.get("env", {}) or {}).items():
        env[str(k)] = str(v)
Confidence
94% confidence
Finding
Copying the entire process environment into a child process is a common secret-leak path because API keys, cloud credentials, and service tokens are often stored in environment variables. In this skill, those inherited secrets are handed to configurable notifier commands, which increases the chance of credential exfiltration if a notifier is compromised or untrusted.

Unvalidated Output Injection

High
Category
Output Handling
Content
success_marker = notifier.get("success_marker", "") or ""

    try:
        proc = subprocess.run(
            argv,
            input=message if use_stdin else None,
            text=True,
Confidence
86% confidence
Finding
Untrusted message content is forwarded directly into subprocesses, either through stdin or through string replacement into notifier arguments. Even without shell invocation here, downstream notifier tools may interpret control sequences, special flags, templating syntax, or structured payloads in dangerous ways, enabling injection into the receiving command or service.

Static analysis

No suspicious patterns detected.