ClawHub
Back to skill

Security audit

Financial Event Historical Impact Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed financial analysis skill that fetches market data and writes local reports, with notable quality and setup cautions but no evidence of hidden, destructive, or exfiltrating behavior.

Before installing, confirm you are comfortable providing a Tushare token, optionally a FRED key, and allowing requests to the disclosed financial data services. Do not paste or display API tokens in chat or logs; check whether a token is set without printing its value. Treat the macro-economy coverage as potentially incomplete until the macro_indicators data-flow bug is fixed, and only run sudo font-install commands after explicit admin review.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
`infer_related_assets()` returns only benefited, harmed, and neutral assets, but does not include `macro_indicators` even when the selected event mapping defines them. This creates a silent integrity failure: downstream analysis, charts, and summaries can omit key macro signals while the tool claims full multi-economy macro coverage, leading users to make decisions on incomplete output.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The docstring states that every item will generate charts, and `get_all_related_indicators()` attempts to include `macro_indicators`, but those indicators are never present in the returned result. In a financial analysis skill, this is dangerous because users may trust the completeness of generated evidence and overlook omitted macro charts that materially affect interpretation.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 检查项 | 命令 | 失败修复 |
|--------|------|---------|
| **中文字体** | `fc-list :lang=zh family` | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` |
| **TUSHARE_TOKEN** | `echo $TUSHARE_TOKEN` | 在 ~/.bashrc 中设置 |
| **输出目录** | `mkdir -p memory/reports/` | 确保有写权限 |
Confidence
91% confidence
Finding
The skill documentation instructs operators to run sudo-based package installation as part of normal execution preparation. In agent or semi-automated environments, encouraging privileged commands increases the chance of unnecessary root execution and system modification beyond the skill's analytical purpose.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 系统 | 安装命令 |
|------|---------|
| **Ubuntu/Debian** | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` |
| **CentOS/RHEL** | `sudo yum install wqy-microhei-fonts` |
| **macOS** | 系统自带 PingFang SC / Heiti SC |
| **Windows** | 系统自带 SimHei（黑体） |
Confidence
92% confidence
Finding
Embedding OS-specific sudo install commands in the skill encourages privilege use on the host machine for a non-essential formatting feature (Chinese fonts). If followed automatically or by a trusting operator, this can alter the host system and widen the blast radius of any future compromise.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| 系统 | 安装命令 |
|------|---------|
| **Ubuntu/Debian** | `sudo apt install fonts-wqy-microhei fonts-noto-cjk` |
| **CentOS/RHEL** | `sudo yum install wqy-microhei-fonts` |
| **macOS** | 系统自带 PingFang SC / Heiti SC |
| **Windows** | 系统自带 SimHei（黑体） |
Confidence
92% confidence
Finding
The documented use of sudo yum similarly normalizes root-level package installation for routine use. Even though this is not overtly malicious, it is dangerous because agent skills should not steer execution toward privileged system changes unless absolutely necessary and explicitly authorized.

Static analysis

No suspicious patterns detected.