ClawHub
Back to skill

Security audit

Hang Seng Indexes Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed public-website monitor that stores local state and can optionally create a scheduled digest job after user confirmation.

Before installing, confirm you are comfortable with a skill that fetches public Hang Seng Indexes content, keeps deduplication state under ~/.config/hsil-monitor by default, and may create a daily OpenClaw cron job if you approve scheduling. Consider replacing the setup script's shell=True command check with shutil.which in a future update.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def check_command(cmd):
    try:
        subprocess.run(["command", "-v", cmd], check=True, capture_output=True, shell=True)
        return True
    except subprocess.CalledProcessError:
        return False
Confidence
96% confidence
Finding
The call to subprocess.run uses shell=True while passing a command lookup operation, which unnecessarily invokes a shell and creates command-injection risk if the command argument ever becomes attacker-controlled. Even though the current requirements list is hardcoded, this is still an unsafe pattern in setup code because future changes or refactoring could expose it, and the current invocation is also semantically incorrect for reliably checking shell builtins across platforms.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The scheduling section instructs the agent to invoke `openclaw cron add` and also documents listing and removal commands, which extends the skill from content monitoring into job management. In environments where tool use is broadly authorized, this can create or modify persistent scheduled actions and increases operational blast radius beyond what is necessary to fetch and summarize website updates.

Unvalidated Output Injection

High
Category
Output Handling
Content
def check_command(cmd):
    try:
        subprocess.run(["command", "-v", cmd], check=True, capture_output=True, shell=True)
        return True
    except subprocess.CalledProcessError:
        return False
Confidence
94% confidence
Finding
This subprocess invocation can expose unvalidated values to shell processing because shell=True causes the shell to interpret command execution semantics. In agent or automation environments, shell-invoking patterns are more dangerous because environment and wrapper behavior may differ, increasing the chance of unintended command execution if the command source ever stops being strictly constant.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def check_command(cmd):
    try:
        subprocess.run(["command", "-v", cmd], check=True, capture_output=True, shell=True)
        return True
    except subprocess.CalledProcessError:
        return False
Confidence
93% confidence
Finding
The code delegates command validation to a shell-enabled subprocess, which is an unsafe tool-usage pattern because it broadens interpretation of parameters beyond literal arguments. In a skill meant for agent-driven execution, this raises risk since tool invocation paths are part of the trusted boundary and should not depend on shell parsing unless strictly necessary.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:138