ClawHub
Back to skill

Security audit

AUSUB

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local gold-investment analysis helper that uses Tushare data and scoped local files, with no evidence of hidden execution, exfiltration, or persistence.

Before installing, understand that this skill will use your Tushare token to query market data and may read project-local config or user-plan JSON files. Prefer a pinned or locked `tushare` install, avoid storing sensitive income or savings details in persistent user-memory files, and treat the output as an informational investment aid rather than guaranteed financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Third-Party Dependency Creates Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill describes access to environment variables and local file read/write behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a least-privilege gap: an agent or reviewer cannot easily tell, ahead of execution, that the skill may access secrets like TUSHARE_TOKEN or read/write local paths such as memory/users/.json and references/history/. In a financial-planning context, this is more sensitive because the skill may touch user-specific financial configuration and local history files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language content in this JSON template is entirely in Chinese, including the display name and user-facing notes. There is no indication that language choice is configurable or that the locale restriction is intentional and documented, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from os.getenv (line 48, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/fetch_history.py (reported line 50)May include surrounding context.

python
data_dir = ensure_data_dir()
    output_path = os.path.join(data_dir, f"{symbol.replace('.', '_')}.csv")

    with open(output_path, "w", newline="", encoding="utf-8") as fh:
        writer = csv.writer(fh)
        writer.writerow(["trade_date", "close"])
        for _, row in df.iterrows():

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This Python file contains extensive user-facing natural-language strings in Chinese, including rationale, action guidance, summaries, and risk text, but there is no indication that the user can opt into this locale or select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation applicable to all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON file contains multiple natural-language fields entirely in Chinese, including the display name and notes. Because SQP-3 applies to all file types and flags language policy issues when a skill forces a specific language without user opt-in, this appears to encode a fixed locale without documenting a user choice or region-specific requirement.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified without a version constraint, which makes builds non-reproducible and can allow unexpected or compromised upstream releases to be installed later. While this file alone does not prove exploitation, unpinned dependencies increase supply-chain risk and can introduce breaking or vulnerable versions without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
tushare

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code initializes an API client with a credential from the environment and performs outbound requests to Tushare to retrieve market data. While failures are surfaced and the final file save is printed, there is no user-facing notice, comment, or docstring here explaining that the script will use the TUSHARE_TOKEN credential and contact an external service.

Content

No source excerpt is available for this finding.