ClawHub
Back to skill

Security audit

Intellectia Stock Forecast

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed stock-forecasting API integration with expected outbound requests and no evidence of hidden persistence, local data collection, or destructive behavior.

Install only if you trust SkillBoss with the ticker queries and analysis prompts you send. Use a scoped SkillBoss API key, avoid private portfolio or account details in free-form chat prompts, and prefer curl or an isolated Python environment if you want to reduce dependency risk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding

Unpinned and Unnecessary Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
metadata: {"openclaw":{"requires":{"bins":["curl","python3"]},"requires_env":["SKILLBOSS_API_KEY"],"install":[{"id":"python","kind":"pip","package":"requests","bins":[],"label":"Install requests (pip)"}]}}

Technical Analysis

The Skill instructs the host to install the requests package without specifying a version, integrity hash, package index, or locked transitive dependency set. Consequently, the package and dependency versions installed are determined by mutable package-index state at installation time rather than by the reviewed Skill artifact.

This creates a supply-chain risk: if the package index, a future package release, a transitive dependency, or the host's package-index configuration is compromised, installation or subsequent import could execute code that was not present during this audit. The dependency is also not required for minimum functionality because the Skill already requires curl, and every documented request can be performed with that existing binary.

No evidence was found that the current requests package is malicious. The vulnerability is the unnecessary and non-reproducible dependency installation mechanism, not a confirmed compromise of the named package.

Attack Path

  1. A user installs or enables the Skill on a host that permits Python package installation.
  2. The installation process resolves the unpinned requests package and its transitive dependencies from the configured package index.
  3. An attacker compromises a resolved package release, a dependency, the configured index, or the package retrieval path.
  4. The host downloads the attacker-controlled package because no version lock or integrity hash rejects it.
  5. Malicious package code executes during a supported ...[truncated 1168 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requests installation declaration and Python example if Python support is not essential. Use the already-required curl binary for the documented HTTPS requests.
  2. If Python support must remain, pin requests and every transitive dependency to reviewed versions.
  3. Use a lock file or requirements file containing cryptographic hashes, and install with hash verification such as pip install --require-hashes.
  4. Explicitly configure an approved HTTPS package index rather than inheriting arbitrary host-level index or mirror settings.
  5. Install dependencies in an isolated virtual environment under a non-privileged account; do not use system-wide or administrator-level package installation.
  6. Generate and review a software bill of materials, and continuously scan pinned dependencies for known vulnerabilities.
  7. Restrict the runtime environment so imported packages can access only the files, environment variables, and network destinations required for the Skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
Single-symbol **forecast** (yearly predictions) and **"Should I Buy?"** analysis via SkillBoss API Hub.

Base URL: `https://api.skillboss.com/v1`

## Overview

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This finding points specifically to the full cURL command showing live outbound transmission to the SkillBoss endpoint with a bearer token header and user query payload. Because it is executable as written, it represents a genuine egress and data-sharing risk, even if that behavior is the skill's intended function.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Example (cURL)

bash
curl -sS -X POST "https://api.skillboss.com/v1/pilot" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"search","inputs":{"query":"TSLA stock price forecast predictions 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035"},"prefer":"balanced"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This finding points specifically to the full cURL command showing live outbound transmission to the SkillBoss endpoint with a bearer token header and user query payload. Because it is executable as written, it represents a genuine egress and data-sharing risk, even if that behavior is the skill's intended function.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Example (cURL)

bash
curl -sS -X POST "https://api.skillboss.com/v1/pilot" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"search","inputs":{"query":"TSLA stock price forecast predictions 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035"},"prefer":"balanced"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The finding shows an authenticated HTTPS POST with JSON payload to a third-party endpoint, which is exactly the kind of external transmission that can leak user content beyond the host environment. Even though this appears to be expected functionality, it remains a true security-relevant behavior because the skill does not enforce any confidentiality controls or data classification before sending data out.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
python3 - <<'PY'
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
r = requests.post(
    "https://api.skillboss.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "TSLA stock price forecast predictions 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035"}, "prefer": "balanced"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The finding shows an authenticated HTTPS POST with JSON payload to a third-party endpoint, which is exactly the kind of external transmission that can leak user content beyond the host environment. Even though this appears to be expected functionality, it remains a true security-relevant behavior because the skill does not enforce any confidentiality controls or data classification before sending data out.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
python3 - <<'PY'
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
r = requests.post(
    "https://api.skillboss.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "TSLA stock price forecast predictions 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035"}, "prefer": "balanced"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The cURL example for chat sends free-form user content to a remote API, increasing the chance that sensitive financial context could be disclosed externally. Because chat prompts are less structured than ticker-only lookups, the skill context makes this somewhat more dangerous than a fixed search query example.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Example (cURL)

bash
curl -sS -X POST "https://api.skillboss.com/v1/pilot" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"chat","inputs":{"messages":[{"role":"user","content":"Should I buy TSLA stock? Provide: conclusion (buy/sell/hold), positive catalysts, negative catalysts, analyst rating, technical analysis, entry point, target price, and 52-week range context."}]},"prefer":"balanced"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The authenticated POST in the analysis example transmits user prompts to a remote LLM-backed service, which can disclose potentially sensitive investment reasoning or other context included in the request. The risk is elevated by the generic chat interface, since users may include more sensitive free-form information than a simple ticker symbol.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
python3 - <<'PY'
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
r = requests.post(
    "https://api.skillboss.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The authenticated POST in the analysis example transmits user prompts to a remote LLM-backed service, which can disclose potentially sensitive investment reasoning or other context included in the request. The risk is elevated by the generic chat interface, since users may include more sensitive free-form information than a simple ticker symbol.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md
python3 - <<'PY'
import requests, os
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
r = requests.post(
    "https://api.skillboss.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={

Static analysis

No suspicious patterns detected.