ClawHub
Back to skill

Security audit

Google Finance Stock Tracker

Security checks for vulnerabilities and agentic risk

Overview

This stock-tracking skill is coherent and does not show hidden malware, but it sends stock symbols to finance sites and produces heuristic investment signals.

Install only if you are comfortable with stock symbols you ask it to check being sent to Google Finance and possibly fallback finance/news sources described in the references. Treat its BUY/HOLD/SELL outputs and stop-loss or target prices as simple heuristics, not professional financial advice, and review any cron or Slack announcement commands before enabling scheduled reports.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/data-sources.md (reported line 138)May include surrounding context.

md
| Yahoo Finance | `https://finance.yahoo.com/rss/headline?s={SYMBOL}` |
| Seeking Alpha | `https://seekingalpha.com/symbol/{SYMBOL}.xml` |

Use `curl -s "{url}" | python3 -c "import sys; from xml.etree import ElementTree as ET; root=ET.parse(sys.stdin).getroot(); [print(i.findtext('title'), '|', i.findtext('pubDate')) for i in root.findall('.//item')[:5]]"`

---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill documents outbound network access and local file writes, but the manifest does not declare any explicit tool scope or permissions boundaries. That creates a capability mismatch: reviewers and runtime policy may not have a clear, enforceable contract limiting what the skill can access, increasing the risk of unintended data access or expanded behavior if the referenced script changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description includes broad trigger phrases such as 'buy or sell', 'stock news', and 'Google Finance', which can cause the skill to be invoked in situations beyond narrow stock-tracking intent. Over-broad invocation increases the chance of accidental activation, causing unsolicited network requests, file updates, scheduled actions, or financial recommendations in contexts where the user did not clearly request this skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/parse-stock.py (reported line 4)May include surrounding context.

python
#!/usr/bin/env python3
# SECURITY MANIFEST
# Accessed variables : none (no environment variables read)
# File operations    : READ/WRITE ~/.openclaw/workspace/stock-tracker-state.json only
# Network            : Google Finance (public, unauthenticated)
# External endpoints : https://www.google.com/finance/quote/*
# Credentials        : none handled or stored

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest states that no user data leaves the machine, but the code transmits user-provided or persisted watchlist symbols to Google Finance via network requests. Even if stock symbols seem low sensitivity, a personalized watchlist can reveal user interests, holdings, or investment intent, so the inaccurate disclosure undermines user trust and consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script materially exceeds a passive stock-tracking/news skill by computing scores, emitting BUY/SELL/HOLD signals, and giving position guidance such as stop-loss and target prices. In an agent context, this can drive consequential financial decisions based on brittle scraping and simplistic heuristics, creating user-harm and liability risk even without direct code-execution impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file instructs the skill to create and read/write ~/.openclaw/workspace/stock-tracker-state.json, which affects user-local state. The section describes the file operations and provides write commands, but it does not include any explicit warning that the skill will create or modify a persistent file on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.