Security audit

Clawback

Security checks across malware telemetry and agentic risk

Overview

ClawBack’s trading purpose is disclosed, but it handles live brokerage access with weak credential handling and several high-impact side effects that need careful review.

Install only if you are comfortable giving this skill E*TRADE credentials and possible real-money trading authority. Use sandbox first, avoid production keys until you have reviewed the code, do not run the debug auth scripts with real credentials, restrict permissions on ~/.clawback, and review any cron/systemd or sudo setup steps before enabling unattended trading.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (96)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: print(f'ERROR: {{e}}') """ result = subprocess.run( [python_cmd, "-c", test_import], capture_output=True, text=True
Confidence: 81% confidence
Finding: The code dynamically constructs Python source in a string and executes it via 'python -c'. Although the interpolated path comes from the local filesystem path of the current script, embedding unsanitized data into executable code is dangerous because special characters in the path could break quoting or alter the executed snippet, leading to unintended code execution in edge cases.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to execute shell commands, create virtual environments, install packages, read and write files under the user's home directory, use environment variables, and access external services, yet it declares no permissions. This creates a trust and review gap: users and platform controls may underestimate the skill's actual capabilities, especially because it can automate broker actions and persist credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill description presents a narrower purpose than the behavior documented in the file, which includes credential handling, token persistence, notifications, background automation, local database writes, and interaction with system utilities. That mismatch is dangerous because users may consent to a market-tracking tool without understanding it also performs sensitive local persistence and potentially unattended execution tied to real-money trading.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation gives inconsistent instructions about where credentials are stored, alternating between ~/.clawback/config.json, .env, and token files. Conflicting secret-handling guidance increases the chance that credentials are stored insecurely, duplicated across locations, or exposed through misconfiguration and troubleshooting mistakes.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The Security section claims environment-variable-based configuration, but earlier setup instructions explicitly write broker credentials into a JSON config file. This inconsistency can mislead users into believing secrets are handled more safely than they are, causing them to accept weaker storage protections for highly sensitive trading credentials.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script prints a live E*TRADE access token prefix to stdout, unnecessarily exposing sensitive authentication material in terminal history, logs, screenshots, or remote session captures. In a trading automation skill, token exposure is especially risky because a valid bearer token may enable account access or downstream API actions without further user interaction.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The file claims to complete OAuth authentication but does not actually perform the authorization-code exchange, instead embedding a hardcoded verification code in output and stopping short of the real flow. This is primarily an integrity and reliability problem: operators may believe authentication was completed when it was not, leading to insecure manual workarounds or mishandling of secrets.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The debug script prints live brokerage authentication material, including request tokens and secrets, directly to stdout. Even if intended for troubleshooting, exposing secrets in terminal output, logs, shell history captures, CI logs, or remote support sessions can enable session hijacking or unauthorized broker API access.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The authentication status routine prints a portion of the broker access token to stdout. Even partial credential disclosure is sensitive because terminals, shell history capture tools, logs, CI output, screen recordings, or remote support sessions may expose token material to unauthorized parties. In a trading skill tied to a brokerage account, leaked token data increases the risk of account compromise or aids attackers in credential harvesting.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The setup flow reads a separate tool's configuration from ~/.openclaw/openclaw.json and reuses its Telegram settings, which expands this CLI's trust boundary to another application's secrets and configuration without clear user consent. This creates cross-tool credential coupling and can expose or misuse unrelated secrets, especially since the code also reveals part of the bot token in console output.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The interactive setup performs live broker authentication, account enumeration, and persists OAuth-related state and access tokens to local disk. In a trading skill, these are highly sensitive account-management capabilities, and storing reusable credentials locally expands the blast radius if the host is compromised or files are exposed.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The alert pipeline always performs broker-integration file writes whenever an alert qualifies, regardless of whether the user explicitly enabled that channel. In a trading automation skill, writing machine-readable alert payloads to a notifications directory can trigger downstream automation or leak sensitive trade intelligence beyond the user’s expected alerting scope.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The comments/frame suggest a passive pickup mechanism, but the code actively creates integration artifacts on disk for every alert. That mismatch can mislead reviewers and users about side effects, reducing informed consent and increasing the chance that downstream broker automation is triggered unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module advertises collection from official government sources, but Senate trade data is actually sourced from a third-party GitHub dataset. In a trading automation skill, this is dangerous because downstream broker execution may rely on unauthenticated, mutable external data that can be poisoned, become stale, or diverge from official disclosures.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The comments and surrounding logic imply official-source collection, but the implementation falls back to community data instead of parsing official Senate results. This mismatch can mislead maintainers, auditors, and users into trusting the provenance and reliability of data that may directly trigger financial trades.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This file implements host-level persistence management by installing/removing cron jobs and creating a systemd user service. Even if intended for automation, persistence mechanisms materially increase the blast radius of the skill because they allow code to keep running outside an interactive session and are broader than a simple data-fetching feature.

Context-Inappropriate Capability

Medium

Confidence: 75% confidence
Finding: This test utility drives a separate authentication workflow that is not obviously aligned with the stated congressional-trading purpose of the skill. In a skill package, unrelated auth helpers can expand the trust boundary, trigger credential handling, and create an opportunity for token collection or execution of sensitive side-effecting code under the guise of testing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The report includes sensitive operational details such as the local config path, broker environment, account identifier, and authentication readiness in a shareable markdown file without redaction guidance. In the context of an automated trading skill, these details materially increase the risk of credential targeting, account enumeration, and follow-on social engineering or local compromise.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The report explicitly changes `dailyLossLimit` from 3% to 5% while framing it as an improvement, but it does not include a clear warning that this materially increases allowed losses and therefore user financial risk. In the context of an automated congressional-trade mirroring skill with broker execution, understated risk changes can mislead operators into deploying a more aggressive configuration than intended.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill advertises automated broker execution near the top but does not provide an explicit, immediate warning that invoking the skill may lead to real-money trades and broker-side actions. In this context, the missing upfront warning is especially risky because the skill is user-invocable and tied to financial accounts, where accidental execution can cause direct monetary loss.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented commands for `run` and `daemon` tell the agent to start the trading bot or background service without any embedded user-facing confirmation or warning about live execution. Because these commands can initiate unattended broker activity, omission of a warning at the point of action materially increases the chance of accidental or misunderstood real-money trading.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Printing even a partial authentication token is a sensitive-data exposure issue because logs and console output are often collected centrally or shared during troubleshooting. In a brokerage integration, any unnecessary disclosure of auth material increases the risk of account compromise and unauthorized trading actions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script prints sensitive credentials and authentication secrets with essentially no masking, which is a direct secret disclosure issue. Anyone with access to the console output, captured logs, terminal scrollback, or monitoring systems could recover reusable credentials or tokens tied to a brokerage account.

Missing User Warnings

High

Confidence: 97% confidence
Finding: After making the authentication URL request, the script logs the auth URL and the updated request token and secret again, increasing exposure of live authentication state. This is especially dangerous because network-generated tokens may be valid for completing or hijacking an OAuth-style authorization flow.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists sensitive authentication material, including request tokens, request secrets, and API credentials, to a local pickle file in the user's home directory without setting restrictive file permissions or clearly warning the user. On multi-user systems or compromised hosts, other local processes or users could read or tamper with this file; using pickle also introduces unsafe deserialization risk if the file is modified before loading.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.