Global Commodity Today

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:46 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent commodity-price lookup tool that fetches public market data and does not show hidden persistence, credential access, local data harvesting, or destructive behavior.

Install only in an environment where you are comfortable running unpinned Python packages and the current ClawHub installer. Treat the returned prices as public market data for reference only, and expect the tool's interface and output to be Chinese-language.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Python Dependencies Allow Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22 and SKILL.md:33; duplicated in README.md:25
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable code:

bash

pip install akshare pandas

Technical Analysis

The installation instructions retrieve akshare and pandas without exact version constraints or integrity hashes. Consequently, the installed code depends on whichever releases the configured Python package index serves at installation time. The effective dependency code can therefore change after this Skill has been reviewed.

If a dependency release, package-maintainer account, package index, or package-resolution path is compromised, an attacker could distribute altered package code. Installation hooks or subsequently imported package code would execute with the privileges of the user running the Skill.

The audited Python script imports both dependencies at startup. Therefore, malicious code placed in either resolved package could also run whenever the commodity-fetching script is invoked.

Attack Path

1. An attacker compromises a dependency publisher, package repository, or applicable package-resolution path.
2. The attacker makes a malicious release of an unconstrained dependency available.
3. A user follows the documented pip install akshare pandas instruction.
4. pip resolves and installs the attacker-controlled release because no vetted version or hash is required.
5. Malicious installation or import-time code executes under the invoking user's account.
6. The malicious dependency gains access to resources available to that account and can affect subsequent Skill execution.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the user installing or running the Skill. The accessible scope may include files, environment data, network access, and credentials available to that account. No ...[truncated 148 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to an exact, reviewed version.
• Maintain dependencies in a version-controlled requirements or lock file.
• Record and verify cryptographic hashes for all packages and transitive dependencies.
• Install with hash enforcement, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Configure an explicitly trusted package index rather than relying on ambient package-manager configuration.
• Review and update pinned dependencies through a controlled process that includes vulnerability scanning and functional testing.
• Apply the same hardened installation instructions consistently in both SKILL.md and README.md.

T08 · Insecure Dependencies

Warning

• Location: README.md:56

Finding

Mutable Latest npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:56
Vulnerability Type: Execution of an unpinned third-party package
Risk Level: Medium

Vulnerable code:

bash

npx clawhub@latest install global-commodity-today

Technical Analysis

The documented command directs npx to retrieve and execute the release currently associated with the mutable latest tag. That release can change after the Skill has been audited, so the command does not guarantee execution of reviewed code.

npx executes package code locally rather than merely downloading static data. A compromised publisher account, npm package, registry response, or future malicious release could therefore turn this documented installation step into an arbitrary code-execution channel. This is classified as an insecure dependency because execution depends on an unpinned package obtained through the package supply chain.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, or the relevant registry delivery path.
2. The attacker publishes a malicious version and assigns or causes the latest tag to resolve to it.
3. A user executes the installation command from the project documentation.
4. npx downloads the version currently identified by latest.
5. npx runs the attacker-controlled package under the user's account.
6. The package can perform arbitrary actions permitted to that account before or while installing the Skill.

Impact Assessment

Exploitation could provide arbitrary local code execution with the invoking user's permissions. The attacker could access or modify user-readable files, consume available credentials, make network requests, or alter the user's development environment. The audited project does not itself elevate privileges, so access beyond the user's existing permissions would require a separate mechanism.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Where supported, verify package provenance and integrity before execution.
• Pin the expected package-manager and runtime versions in the deployment documentation.
• Use a trusted registry explicitly and prevent unexpected registry overrides.
• Test and review each package upgrade before changing the documented version.
• Prefer installation workflows that separate package retrieval and verification from execution.
• Avoid executing mutable remote package tags in production or privileged environments.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install global-commodity-today, which implicitly trusts and executes the latest published package version at install time rather than a pinned, reviewed version. If the package or one of its distribution channels were compromised, users could execute attacker-controlled code during installation; this is especially relevant because npx fetches and runs packages directly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are very broad natural-language requests such as asking for today's commodity market or a gold price, without explicit boundaries on when the skill should or should not activate. In an agentic environment, this can cause unintended invocation, leading to unnecessary external data access, user confusion, or the skill being selected in contexts where the user did not clearly consent to this specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language descriptions and messages exclusively in Chinese, including the module docstring and CLI help text. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argparse description, help text, and error messages are user-facing and are all hard-coded in Chinese. This imposes a specific language on users without offering a choice or clearly documenting that the skill is region- or locale-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.