ClawHub
Back to skill

Security audit

Ripe Scanner

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real market-scanning skill, but it needs review because it claims local/no-key operation while making third-party network requests, optionally using a Tavily API key, and writing an unsafe shared cache.

Install only if you are comfortable with the skill contacting market and sentiment services, sending ticker interests to third parties, and using TAVILY_API_KEY for Tavily-backed Reddit sentiment when that environment variable exists. Prefer running it in a dedicated environment, avoid sudo, review or disable the /tmp cache on shared systems, and treat its output as informational rather than financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ripe-scan.py:783
Finding

Predictable Shared Temporary Cache Allows Local Cache Poisoning and Symlink Attacks

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:15
Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

other

Note
Location
scripts/ripe-scan.py:231
Finding

Documentation Misrepresents Tavily Credential and Data-Disclosure Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ripe-scan.py (reported line 217)May include surrounding context.

python
try:
        url = f"https://api.stocktwits.com/api/2/streams/symbol/{clean_sym}.json"
        req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
        resp = json.loads(urllib.request.urlopen(req, timeout=10).read())
        messages = resp.get('messages', [])
        if not messages:
            return None

Tainted flow: 'req' from os.environ.get (line 245, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
95% confidence
Finding

The code reads TAVILY_API_KEY from the environment and includes it in a JSON body sent to an external service. While this is expected for authenticating to Tavily, it still transmits a secret off-host without explicit user-facing disclosure, and any compromise or misuse of that endpoint could expose or abuse the credential. In this skill context, outbound use of ambient credentials is more sensitive because the manifest presents a scanner and the header claims 'fully local computation'.

Content

Scanner excerpt · scripts/ripe-scan.py (reported line 247)May include surrounding context.

python
}).encode()
        req = urllib.request.Request('https://api.tavily.com/search', data=data,
                                     headers={'Content-Type': 'application/json'})
        resp = json.loads(urllib.request.urlopen(req, timeout=10).read())
        posts = resp.get('results', [])
        if not posts:
            return None

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises command execution that uses network access, reads environment-dependent paths, and writes persistent files, but it does not declare any tool scope or permissions boundaries. This weakens auditability and consent, because an agent may invoke a skill with broader capabilities than the user expects, including outbound requests and disk writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are broad enough to match many generic investing or market questions, increasing the chance this skill is auto-selected when the user did not intend to run a networked, file-writing scanner. Overbroad routing is dangerous because it can cause unnecessary execution of code with side effects and expose user workflows to unintended external data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The markdown states that daily snapshots and signal logs are stored persistently under the workspace memory path, but it does not prominently warn the user before enabling retention. Persistent writes can create privacy, storage, and data governance issues, especially if users do not realize market activity history and generated logs are being accumulated over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring claims 'Zero API cost, fully local computation,' but the implementation fetches data from Wikipedia, Yahoo Finance, StockTwits, and optionally Tavily. This mismatch is a security-relevant transparency issue because users may authorize the skill under false assumptions about data locality and network exposure. Misrepresentation increases risk in an agent setting where users rely on manifests and descriptions to judge trust boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code contradicts its own claim of local-only operation by relying on remote services and an environment API key for Tavily. This is dangerous because it obscures both external data flows and credential use, undermining informed consent and safe deployment decisions. In a skill marketplace context, inaccurate declarations are especially problematic because they can bypass user scrutiny.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code sends ticker symbols to StockTwits, creating an external data flow that is not clearly disclosed to users. The transmitted data is low sensitivity, but it still leaks user interest or queried assets to a third party and conflicts with the claim of local-only operation. In context, this is more of a privacy/transparency issue than a severe exploit path.

Content

Scanner excerpt · scripts/ripe-scan.py (reported line 215)May include surrounding context.

python
# Skip crypto tickers on StockTwits (different format)
    clean_sym = symbol.replace('-USD', '.X') if '-USD' in symbol else symbol
    try:
        url = f"https://api.stocktwits.com/api/2/streams/symbol/{clean_sym}.json"
        req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
        resp = json.loads(urllib.request.urlopen(req, timeout=10).read())
        messages = resp.get('messages', [])

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This request transmits both query content and an API key-backed request to Tavily, exposing the user's looked-up symbols and relying on a third-party service. The main risk is undisclosed external transmission coupled with credential use; if the remote service is compromised or logs are mishandled, both usage metadata and secret-backed access may be affected. The mismatch with the advertised local behavior makes this more concerning.

Content

Scanner excerpt · scripts/ripe-scan.py (reported line 245)May include surrounding context.

python
'search_depth': 'basic',
            'max_results': 10
        }).encode()
        req = urllib.request.Request('https://api.tavily.com/search', data=data,
                                     headers={'Content-Type': 'application/json'})
        resp = json.loads(urllib.request.urlopen(req, timeout=10).read())
        posts = resp.get('results', [])

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill persists snapshots and signal logs under the user's workspace and home directory, creating longer-lived local state than the description suggests. Persistent storage is not inherently malicious, but undisclosed retention can expose trading interests, usage history, and derived analytics to other local processes, backups, or later agents with filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script creates cache and history files in /tmp and the user's home workspace without a clear warning. Although the stored content is not highly sensitive by default, it can reveal watchlists, scan behavior, signal history, and timestamps, which may matter in multi-user or shared-agent environments. The issue is primarily undisclosed persistence rather than direct code execution or exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill silently reads an environment API key and uses it in an outbound request path, without explicit disclosure in the interface or description. Even though using a key for API access is normal, undisclosed consumption of ambient credentials is risky in agent ecosystems because users may not expect a 'free' scanner to leverage existing secrets. The danger is increased by the misleading 'fully local' claim.

Content

No source excerpt is available for this finding.