A Stock Daily Review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 2.0.0

Overview

This is a disclosed A-share market reporting skill, but users should treat its portfolio data and WeChat delivery as sensitive and verify its dependency installs.

Before installing, verify the dependency skills and prefer pinned or reviewed versions. Do not put portfolio data in the configured file unless you are comfortable with that information being used in the generated report and potentially sent to WeChat.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:49

Finding

Unpinned Third-Party Skill Installation Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 49-55
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx clawhub install a-stock-trading-assistant --dir skills
npx clawhub install a-stock-market --dir skills
npx clawhub install china-stock-analysis --dir skills
npx clawhub install china-a-stock-trader --dir skills
npx clawhub install a-share-signal --dir skills

Technical Analysis

The installation instructions execute clawhub through npx without pinning the CLI to a reviewed version. They also install five third-party skills without specifying immutable versions, commit identifiers, integrity hashes, signatures, or verified publishers.

As a result, the content executed or installed when a user follows these instructions may differ from the content that existed when this project was reviewed. An attacker who compromises the package distribution channel, a publisher account, the clawhub package, or one of the named skill packages could introduce malicious code into a subsequent release. Package installation may execute lifecycle code, while an installed skill may later execute with the capabilities granted to the Agent environment.

The external dependencies are not included in this repository, so their implementation and behavior could not be audited as part of this assessment. The repository itself contains no confirmed malicious executable payload.

Attack Path

1. An attacker compromises or gains control of the clawhub package or one of the five referenced skill packages.
2. The attacker publishes a malicious release under the expected package or skill name.
3. A user follows the documented installation instructions.
4. Because no immutable versions or integrity values are specified, npx or clawhub retrieves the attacker-controlled release.
5. Malicious installation hooks or skill code execute under the invoking user's a ...[truncated 949 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the clawhub CLI to a specific reviewed version instead of invoking an unspecified latest release through npx.
2. Pin every referenced skill to an immutable reviewed version or commit identifier.
3. Publish and verify cryptographic checksums or signatures for the CLI and each installed skill.
4. Use a trusted, access-controlled registry and verify package publisher identities before installation.
5. Maintain a lockfile or vendor reviewed dependency artifacts so installations are reproducible.
6. Audit the complete source and installation behavior of every external skill before recommending it to users.
7. Perform installation and execution in a sandbox with minimal filesystem, credential, and network access.
8. Avoid running the installation commands with administrative privileges.
9. Document the exact approved versions and an update-review process so dependency upgrades receive a new security assessment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx clawhub install ... without pinning an exact package version or verifying integrity. Because npx resolves and executes packages from a remote registry at install time, a compromised latest release, dependency hijack, or supply-chain takeover could cause arbitrary code execution on the user's machine during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This installation command uses npx clawhub without any version pinning, so the command depends on whatever package version is current at execution time. That creates a supply-chain risk where a malicious or tampered package update could execute arbitrary code under the user's account when they follow the README.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Running this unpinned npx clawhub command exposes users to mutable upstream content from the npm ecosystem. In the context of an agent skill that users are expected to trust and install, this increases the chance of silent compromise through a malicious package update or dependency substitution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command fetches and executes a remote package with npx but does not constrain the version, making the install path non-reproducible and vulnerable to supply-chain attacks. If the referenced package or one of its dependencies is compromised, an attacker could gain code execution during installation of the skill ecosystem.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This README line repeats the same unsafe pattern of instructing users to execute an unpinned npx install command. Even though the skill is about stock analysis rather than system administration, the setup step still runs code locally, so the business context does not reduce the technical risk of arbitrary code execution from an upstream package compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises automatic delivery of a full market analysis report to WeChat, which implies external transmission of potentially sensitive financial data. Because the skill also supports local portfolio tracking, users may reasonably assume their holdings or derived analysis could be included in outbound messages without having been clearly warned or asked for explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs users to place detailed portfolio holdings, including stock codes, position size, and cost basis, into a local file without warning that this constitutes sensitive financial information. In the context of an automated analysis-and-push workflow, this omission increases the risk that users expose private investment data to the skill and potentially to downstream outputs or integrations without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.