Clawback

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:44 AM UTC
• Version: 1.1.1

Overview

The skill has a coherent trading purpose, but it needs Review because it handles real brokerage credentials and trades while storing or exposing sensitive tokens insecurely and using overbroad installation steps.

Review carefully before installing. Use sandbox only unless the token storage, secret logging, pickle helper, and sudo global symlink are fixed. Expect E*TRADE credentials and OAuth tokens to be stored locally in plaintext despite the encryption claim, and rotate any credentials already used with this package.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: src/clawback/config_loader.py:156

Finding

Broker credentials and OAuth tokens are stored in plaintext without enforced access controls

Content

View full analysis

None: """Save tokens to file with metadata""" tokens['saved_at'] = datetime.now().isoformat() tokens['config_path'] = self.config_path os.makedirs(os.path.dirname(self.tokens_file), exist_ok=True) with open(self.tokens_file, 'w') as f: json.dump(tokens, f, indent=2) print(f"✅ Tokens saved to {self.tokens_file}") ``` ```python # src/clawback/database.py:92-105 CREATE TABLE IF NOT EXISTS broker_tokens ( id INTEGER PRIMARY KEY AUTOINCREMENT, broker TEXT NOT NULL, account_id TEXT, access_token TEXT NOT NULL, access_secret TEXT, refresh_token TEXT, token_type TEXT DEFAULT 'oauth1', expires_at TIMESTAMP, last_refreshed TIMESTAMP DEFAULT CURRENT_TIMESTAMP, ...[truncated 3154 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: fix_auth.py:19

Finding

Unsafe pickle deserialization permits arbitrary local code execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/clawback/cli.py:171

Finding

Authentication and Telegram secrets are exposed through console and log output

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: setup.sh:73

Finding

Installation unnecessarily invokes sudo to replace a global executable

Content

View full analysis

/dev/null || true ``` ### Technical Analysis The Skill can be executed through its local wrapper or Python package entry point, so modifying `/usr/local/bin` is not necessary for its declared operation. The installer nevertheless invokes `sudo` and forcibly replaces `/usr/local/bin/clawback` with a symlink to a file in the current project directory. The destination is global, while the symlink target may remain writable by an unprivileged user. This creates a trust mismatch: callers may treat a command under `/usr/local/bin` as administrator-installed software even though its effective implementation resides in a mutable user-controlled directory. The operation can also overwrite an unrelated or previously trusted `clawback` command without checking ownership or obtaining specific confirmation. ### Attack Path 1. The user runs `setup.sh` and approves the sudo prompt. 2. The script replaces `/usr/local/bin/clawback` with a symlink into the current working directory. 3. The project directory or `bin/clawback.py` is later modified by a compromised account, malicious update, or another process with write access. 4. Any user or automation invoking `/usr/local/bin/clawback` executes the modified target. 5. The modified launcher inherits the invoking user's access to files, environment variables, and brokerage configuration. A related availability path is that installation from a temporary directory leaves a stale global command after the directory is removed. ### Impact Assessment The installation crosses from user-level Skill setup into a privileged, system-wide namespace. It can replace an existing command and expose all future ca ...[truncated 287 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unpinned dependencies are installed without integrity verification

Content

View full analysis

=2.28.0 requests-oauthlib>=1.3.0 pdfplumber>=0.9.0 beautifulsoup4>=4.11.0 selenium>=4.10.0 webdriver-manager>=4.0.0 pandas>=1.5.0 yfinance>=0.2.0 schedule>=1.2.0 lxml>=4.9.0 pytest>=7.0.0 pytest-cov>=4.0.0 ``` ```bash # setup.sh:22-27 source venv/bin/activate # Install dependencies echo "Installing dependencies..." pip install --upgrade pip pip install -e . ``` The package metadata similarly uses mutable lower bounds: ```toml dependencies = [ "requests>=2.28.0", "requests-oauthlib>=1.3.0", "pdfplumber>=0.9.0", "beautifulsoup4>=4.11.0", "pandas>=1.5.0", "yfinance>=0.2.0", "schedule>=1.2.0", "lxml>=4.9.0", ] ``` ### Technical Analysis Every fresh installation may resolve to different package versions because only minimum versions are specified. No lockfile, exact version set, or package hash verification is present. The setup script also upgrades pip from the network before installing the project. A lower-bound specification is not itself evidence that a dependency is malicious. However, it allows newly published versions to enter a security-sensitive trading environment without project review or reproducibility. Dependencies and their transitive packages execute installation and runtime code with access to the process environment and local files. This is especially consequential because the application handles brokerage credentials and can submit financial orders. ### Attack Path 1. A dependency or transitive dependency account is compromised, or a malicious release is published under an already trusted package name. 2. A user performs a new ClawBack setup after that release becomes the newest compatible version. 3. Pip resolve ...[truncated 823 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (208)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · src/clawback/telegram_notifier.py (reported line 34)May include surrounding context.

python

legram notifications for trading activities"""

    def __init__(self, config):
        self.config = config.get('telegram', {})
        self.enabled = self.config.get('enabled', False)
        self.bot_token = self.config.get('botToken', '')
        self.chat_id = self.config.get('chatId', '')

        # Check for OpenClaw mode
        self.use_openclaw = self.config.get('useOpenClaw', False) or os.environ.get('OPENCLAW_SESSION')

        if self.use_openclaw and _is_openclaw_available():
            self.enabled = True
            self.mode = 'openclaw'
            logger.info("Telegram notifier using OpenClaw channel")
        elif self.enabled and self.bot_token and self.chat_id:
            self.mode = 'standalone'
            logger.info("Telegram notifier using direct Bot API")
        elif self.enabled:
            logger.warning("Telegram enabled but token or chat ID missing")
            self.enabled = False
            self.mode = None
        else:
            self.mode = N

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DAILY_MAINTENANCE_2026-02-04.md (reported line 37)May include surrounding context.

md

- **Config File**: `~/.clawback/config.json` (2.2KB)
- **Format**: Valid JSON with all required sections
- **Credentials**: E*TRADE sandbox credentials present
- **Access Tokens**: Exist and appear valid

### ✅ 6. Performance Check
- **Status**: Excellent

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Manual OAuth-style authorization, token acquisition/storage, and account connectivity are high-sensitivity functions, yet the top-level promise focuses on mirrored trading based on disclosures rather than on credentialed broker access. This mismatch increases the chance of unsafe consent and credential exposure in a financial context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.