ClawHub
Back to skill

Security audit

juglans market price (ALL markets, ALL realtime)

Security checks for vulnerabilities and agentic risk

Overview

The price lookup skill itself is coherent, but its documented installer uses unverified mutable remote downloads, including a repository mismatch that could install different future instructions than the reviewed package.

Review carefully before installing. Prefer the ClawHub package or a locally inspected SKILL.md over the README curl-to-bash flow. Do not run the one-line installer unless the publisher pins the download to a reviewed immutable commit or release and provides integrity verification; the repository mismatch in install.sh should be fixed before trusting that installer.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:33
Finding

Unverified Remote Installation Script Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: README.md:33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/install.sh | bash

Technical Analysis

The documented installation command downloads a shell script from the mutable main branch and passes the response directly to Bash. The payload is not pinned to an immutable commit and is not authenticated through a cryptographic signature or verified checksum. The user also has no opportunity to inspect the downloaded script before it executes.

Hosting the script on GitHub does not eliminate the risk. Compromise of the repository, maintainer account, or content-delivery path could alter the effective payload after this project has been reviewed. The installation only needs to place SKILL.md in a user-level Skill directory, so immediate execution of arbitrary remote shell content exceeds the minimum privileges necessary for the declared functionality.

Attack Path

  1. An attacker compromises the upstream repository or an account authorized to modify its main branch.
  2. The attacker replaces install.sh with a malicious shell payload.
  3. A user follows the installation command from README.md.
  4. curl retrieves the attacker-controlled response.
  5. The shell pipe sends that response directly to Bash without review or integrity verification.
  6. The payload executes with all permissions held by the installing user.

Impact Assessment

The payload can execute arbitrary commands with the installing user's privileges. Depending on that user's environment, this can expose or modify personal files, source code, shell configuration, API credentials, SSH keys, Claude configuration, and other user-accessible data. It could also install user-level persistence or download additional payloads. The audited command does not itself request root privi ...[truncated 58 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation method.
  • Prefer copying the reviewed SKILL.md included in the distributed package.
  • If a script must be downloaded, pin it to an immutable release or full commit hash.
  • Publish and verify a cryptographic signature or SHA-256 digest before execution.
  • Download the script to a local file, allow inspection, and execute it only as a separate explicit step.
  • Keep installation user-scoped and avoid requesting sudo or other elevated privileges.

T08 · Insecure Dependencies

Error
Location
install.sh:4
Finding

Installer Retrieves Mutable Skill Instructions from a Different Repository

Content
View full analysis

Vulnerability Details

File Location: install.sh:4-9
Vulnerability Type: Unverified supply-chain dependency
Risk Level: High

bash
SKILL_DIR="${HOME}/.claude/skills/price"
REPO_URL="https://raw.githubusercontent.com/juglans-ai/juglans-price/main"

echo "Installing juglans-price skill..."

mkdir -p "$SKILL_DIR"
curl -fsSL "$REPO_URL/SKILL.md" -o "$SKILL_DIR/SKILL.md"

Technical Analysis

The installer does not install the SKILL.md contained in the audited package. Instead, it downloads mutable content from the main branch of juglans-ai/juglans-price, while the README installation URL and project name refer to juglans-ai/juglans-market-price.

This repository mismatch makes it unclear whether the fetched component is the intended dependency. No commit pin, checksum, signature, or content validation binds the installed file to the reviewed version.

The downloaded file is written directly into ~/.claude/skills/price/SKILL.md, a trusted Agent Skill location. Although the shell script does not execute the downloaded file as native code, Claude can load its instructions after restart. Consequently, control of the remote dependency can provide control over future Skill instructions and associated tool-use guidance.

Attack Path

  1. An attacker gains control of, or write access to, juglans-ai/juglans-price.
  2. The attacker modifies main/SKILL.md to include unsafe Agent instructions or dangerous Bash operations.
  3. A user executes the installer from the audited project.
  4. The installer downloads the modified file without checking its origin, version, signature, or digest.
  5. The file is saved under ~/.claude/skills/price/SKILL.md.
  6. After Claude Code restarts, the unaudited instructions can be loaded as the installed price Skill.
  7. If invoked, those instructions may influence Agent behavior or direct use of the allowed Bash tool.

Impact Assessment

A compromised depende ...[truncated 536 chars]

Remediation
View remediation

Remediation Suggestions

  • Install the SKILL.md packaged with and reviewed as part of this project.
  • Correct the repository mismatch if remote retrieval is genuinely required.
  • Pin downloads to an immutable full commit hash or signed release.
  • Verify a published cryptographic signature or checksum before writing the file into the Skill directory.
  • Download to a staging path and validate the Skill metadata, allowed tools, and instruction content before activation.
  • Fail installation if the expected repository identity, version, or digest does not match.

T08 · Insecure Dependencies

Warning
Location
README.md:38
Finding

Manual Installation Places Unpinned Remote Instructions into a Trusted Skill Directory

Content
View full analysis

Vulnerability Details

File Location: README.md:38-40
Vulnerability Type: Unverified supply-chain dependency
Risk Level: Medium

bash
mkdir -p ~/.claude/skills/price
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/SKILL.md \
  -o ~/.claude/skills/price/SKILL.md

Technical Analysis

The manual installation method downloads SKILL.md from a mutable branch and writes it directly into Claude's trusted Skill directory. The command does not pin a reviewed revision or verify a checksum or signature.

Unlike the one-line installer, this command does not immediately pass the response to a native shell interpreter. Nevertheless, the downloaded content consists of Agent instructions and is installed in a location from which Claude can load it. A later change to the upstream branch can therefore cause users to install content that differs from the version assessed in this audit.

Attack Path

  1. An attacker modifies main/SKILL.md after compromising the upstream repository or maintainer account.
  2. A user follows the manual installation instructions.
  3. curl retrieves the modified Skill without revision pinning or integrity verification.
  4. The response overwrites ~/.claude/skills/price/SKILL.md.
  5. Claude Code is restarted and loads the attacker-controlled instructions.
  6. Invoking the Skill exposes the session to the modified behavior and any unsafe tool-use instructions it contains.

Impact Assessment

Exploitation can influence the installed Skill's behavior across future Claude Code sessions until the file is removed or replaced. Because the reviewed Skill declares Bash as an allowed tool, malicious replacement instructions could attempt to induce command execution or unauthorized network and file operations under the user's permissions. Actual effects remain subject to the Agent runtime's approval and sandbox controls. The audited command provides no dire ...[truncated 39 chars]

Remediation
View remediation

Remediation Suggestions

  • Use the local SKILL.md shipped in the reviewed package rather than downloading mutable branch content.
  • If remote installation is retained, use an immutable release asset or full commit URL.
  • Publish and verify a checksum or cryptographic signature before placing the file in ~/.claude/skills.
  • Download to a temporary staging location, display the content for review, and require a separate activation step.
  • Avoid silently overwriting an existing Skill; warn the user and preserve a backup.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network content into bash creates an immediate command-execution chain with no integrity verification, confirmation prompt, or inspection step. In the context of a skill install guide, this is more dangerous because users are being encouraged to establish persistent local agent functionality via an opaque bootstrap path.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

One-line install

bash
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/install.sh | bash

Manual install

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Manual install

bash
mkdir -p ~/.claude/skills/price
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/SKILL.md \
  -o ~/.claude/skills/price/SKILL.md

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Manual install

bash
mkdir -p ~/.claude/skills/price
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/SKILL.md \
  -o ~/.claude/skills/price/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

bash
mkdir -p ~/.claude/skills/price
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/SKILL.md \
  -o ~/.claude/skills/price/SKILL.md

ClawHub

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is broad enough to trigger on many general finance or market-related requests, which can cause the agent to invoke an external data-fetching tool more often than necessary. Over-broad activation increases the chance of unintended tool use, privacy leakage of user queries to a third-party service, and workflow interference when the user wanted discussion or analysis rather than live retrieval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage instruction says to use the skill when the user asks about any price, stock quote, crypto price, exchange rate, or market data, but it does not define clear boundaries or disambiguation steps. In practice, this can over-trigger on ambiguous requests and route broad financial conversations into external API calls, creating unnecessary data sharing and reducing agent control over when tools should be used.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The README instructs users to fetch and execute a remote script directly with curl | bash, which bypasses review and creates a supply-chain execution risk. If the GitHub account, repository, branch, or network path is compromised, arbitrary code would run immediately on the user's machine.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

One-line install

bash
curl -fsSL https://raw.githubusercontent.com/juglans-ai/juglans-market-price/main/install.sh | bash

Manual install

Static analysis

No suspicious patterns detected.