ClawHub
Back to skill

Security audit

US Stock Financials

Security checks across malware telemetry and agentic risk

Overview

The skill appears to fetch SEC financial data as advertised, but it silently weakens HTTPS checks if normal secure fetching fails.

Review or patch the network helper before installing, especially if you may rely on the output for financial decisions. Remove the insecure TLS fallback or require an explicit debug opt-in, and install reportlab in a virtual environment rather than modifying system Python packages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The code explicitly falls back to an SSL context with hostname checking disabled and certificate verification set to CERT_NONE, then uses that context for SEC HTTP requests. This permits man-in-the-middle interception and response tampering, which is especially risky because fetched financial data is trusted for output generation and reporting.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.