Security audit

Trade Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent trade-logging purpose, but its instructions route user-controlled trade text through a shell command and require running an unbundled local script outside the reviewed package.

Review this skill before installing. Its trade-log goal is reasonable, but it should bundle the Python script and pass JSON through a safe argument array or stdin rather than interpolating it into shell text. Install only if you trust the local save.py at the referenced path and understand it can append persistent trading records on your machine.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:37
Finding: Shell Command Injection Through User-Controlled JSON Input
Content: View full analysis
' ``` ### Technical Analysis The workflow instructs the agent to interpolate a JSON object containing user-controlled fields directly into a single-quoted Bash command. JSON validation does not provide shell escaping because Bash parses the command before `save.py` receives the argument. A single quote in any string field, such as `note` or `source`, can terminate the surrounding shell quote. The remaining content may then introduce shell operators and arbitrary commands. Merely producing valid JSON is insufficient to prevent this issue when the serialized JSON is subsequently embedded in shell syntax. For example, a malicious field could contain content conceptually equivalent to: ```text '; attacker_command; # ``` If inserted without shell-safe argument handling, the first quote closes the JSON argument, the injected command is interpreted by Bash, and the comment marker can suppress the remaining generated command text. ### Attack Path 1. An attacker asks the agent to save a trade containing crafted text in a user-controlled field such as `note`. 2. The crafted value includes a single quote, shell separators, and an attacker-selected local command. 3. The agent serializes the trade as JSON and substitutes it for `` in the documented Bash command. 4. Bash terminates the quoted a ...[truncated 821 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Mandatory Execution of an Unbundled and Unverifiable External Script
Content: View full analysis
' ``` The mandatory execution requirement is also stated at lines 82-84: ```text - Always APPEND to the file, never overwrite existing trades. - Create directory and file automatically if they do not exist. - Always run the script — never simulate or fake a save confirmation. ``` ### Technical Analysis The audited project contains only `SKILL.md`; the referenced `save.py` implementation is not included. The instructions nevertheless require execution of a script at a hard-coded path outside the audited project directory. As a result, the effective executable behavior cannot be verified against the documentation. The file at that location may be absent, may differ between installations, or may be replaced independently of the reviewed skill. The audit therefore cannot confirm the claimed JSON validation, append-only behavior, output handling, or absence of additional side effects. This is a trust-boundary flaw: reviewed instructions cause execution of an unreviewed local component whose identity and integrity are not established by the package. ### Attack Path 1. A file exists or is placed at `~/.npm-global/lib/node_modules/openclaw/skills/trade-memory/save.py`. 2. That file is modified, replaced, or otherwise differs from the implementation implied by the documentation. 3. A user requests th ...[truncated 1122 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.