Security audit

Stock TA Charts

Security checks for vulnerabilities and agentic risk

Overview

This chart skill mostly matches its stated purpose, but it also tells the agent to send generated charts to a fixed Telegram recipient and to run an unaudited local Python module.

Review before installing. Only use this skill if you trust the local ~/clawd/crypto_charts.py file it will execute, and do not allow it to send charts through Telegram unless you replace the hard-coded recipient with a user-chosen, confirmed destination.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:87
Finding: Generated Charts Are Sent to a Hard-Coded Telegram Recipient
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:9
Finding: Unverified Local Python Module Is Imported and Executed
Content: View full analysis
&1 ``` ``` The single-chart workflow imports the same unverified module: ```python from crypto_charts import ( fetch_yfinance, fetch_ohlc, fetch_market_data, calc_moving_averages, calc_rsi, calc_fibonacci, detect_patterns, generate_chart, COINS ) ``` ### Technical Analysis The project contains only `SKILL.md` and `_meta.json`; it does not include the referenced `crypto_charts.py` implementation. The documented command changes the working directory to `~/clawd` and imports `crypto_charts` from the active Python import path. Python executes module-level code as soon as a module is imported. Therefore, a file or package named `crypto_charts` that is already present or later placed in the import path can execute code before any of the expected chart functions are called. The skill does not pin an implementation, verify a hash or signature, validate the resolved module path, or isolate execution. The imported module is also expected to perform network retrieval, chart creation, and cleanup. Because its source is absent, the audit cannot verify its network destinations or confirm that `cleanup_old_charts()` limits deletion to the intended chart directory. The full-suite command also uses `os.path.expanduser(...)` without importing `os`. This causes ...[truncated 1685 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to send generated chart images to a hard-coded Telegram target without any user confirmation, recipient validation, or warning about external data sharing. Even if the chart content seems low sensitivity, this creates an exfiltration path to an unintended third party and normalizes outbound messaging behavior that could be reused for more sensitive files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.