ClawHub
Back to skill

Security audit

Interactive Brokers Suite

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed read-only Interactive Brokers analytics toolkit that stores account data and Flex credentials locally but does not show order placement, hidden exfiltration, or destructive behavior.

Install only in a private workspace you trust with brokerage account data. Before using Flex features, ensure .ib-suite/config.yaml and .ib-suite/data are excluded from version control and protected because they may contain plaintext Flex tokens, query IDs, account identifiers, snapshots, and reports. Prefer paper mode for first setup, keep IB Gateway Read-Only API enabled, and pin or lock dependencies before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Unpinned Dependencies

Low
Category
Supply Chain
Content
-e ./ib-common
ib_async>=1.0.1
requests>=2.31
pytest>=8.0
Confidence
95% confidence
Finding
ib_async>=1.0.1

Unpinned Dependencies

Low
Category
Supply Chain
Content
-e ./ib-common
ib_async>=1.0.1
requests>=2.31
pytest>=8.0
Confidence
98% confidence
Finding
requests>=2.31

Unpinned Dependencies

Low
Category
Supply Chain
Content
-e ./ib-common
ib_async>=1.0.1
requests>=2.31
pytest>=8.0
Confidence
97% confidence
Finding
pytest>=8.0

Known Vulnerable Dependency: pyarrow — 9 advisory(ies): CVE-2023-47248 (PyArrow: Arbitrary code execution when loading a malicious data file); CVE-2019-12408 (Missing Initialization of Resource in Apache Arrow); CVE-2019-12410 (Missing Initialization of Resource in Apache Arrow) +6 more

Critical
Category
Supply Chain
Confidence
80% confidence
Finding
pyarrow

Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium
Category
Supply Chain
Confidence
88% confidence
Finding
requests==2.31

Known Vulnerable Dependency: pytest==8.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High
Category
Supply Chain
Confidence
84% confidence
Finding
pytest==8.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.