ClawHub
Back to skill

Security audit

Market Events

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Financial Modeling Prep market-calendar skill; its main issue is dependency hygiene, not hidden or malicious behavior.

Install only if you are comfortable using an FMP API key for market-event lookups. Use a dedicated, revocable FMP key, point --file only at simple ticker lists, and prefer a version that pins requests to a maintained safe release.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests
Confidence
97% confidence
Finding
The dependency is unpinned, so installs may pull different versions over time, including versions with regressions or newly introduced vulnerable transitive behavior. In a skill that makes outbound HTTP requests to a market-data provider, this weakens reproducibility and can unintentionally expose the runtime to known-bad releases.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
The requirements file specifies requests without a safe version bound, while static analysis indicates multiple known advisories affecting requests. Because this skill likely performs network calls to external services and may handle API keys or ambient credentials, vulnerable requests versions can enable credential leakage, TLS/verification issues, or other client-side request handling weaknesses.

Static analysis

No suspicious patterns detected.