ClawHub
Back to skill

Security audit

fund-analysis

Security checks for vulnerabilities and agentic risk

Overview

This is a financial data analysis skill with disclosed public-market data dependencies and no evidence of hidden commands, credential use, persistence, or destructive behavior.

Install dependencies in an isolated virtual environment, avoid running `pip install` with elevated privileges, and treat generated financial analysis as informational rather than investment advice. Be aware that the package appears to document `fund_daily_report.py` but does not ship that script in the inspected artifact.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:132
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132–135
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

bash
pip install akshare pywencai pandas numpy

Technical Analysis

The installation instructions request four third-party Python packages without fixed versions, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, installation resolves whatever compatible releases are available from the configured package repository at execution time.

Python package installation can execute package-controlled build or installation logic. If a dependency or its distribution channel is compromised, a user following these instructions could install and execute an altered release that was not reviewed with this project. The absence of version constraints also makes installations non-reproducible and increases exposure to newly introduced vulnerabilities or incompatible behavior.

The audited project does not itself contain a malicious dependency or executable implementation. The risk arises from the unsafe dependency installation procedure documented by the skill.

Attack Path

  1. A user follows the dependency installation command in SKILL.md.
  2. pip resolves the latest eligible releases from the user's configured package index.
  3. An attacker compromises an upstream package, its maintainer account, or the package distribution channel and publishes a malicious release.
  4. pip downloads that mutable release because no reviewed version or hash is enforced.
  5. Package-controlled code executes during installation, build, or subsequent import by the financial-analysis workflow.
  6. The malicious dependency operates with the privileges and accessible resources of the user running the installation or analysis.

Impact Assessment

Successful exploitation could provide code execution under the installing user's account. Accessible ...[truncated 413 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct and transitive dependency to a reviewed version in a committed requirements or lock file.
  • Generate and enforce cryptographic hashes, for example by installing with pip --require-hashes.
  • Configure an explicitly trusted package index rather than relying on arbitrary user-level index configuration.
  • Regularly scan locked dependencies for known vulnerabilities and review updates before changing pinned versions.
  • Install dependencies inside an isolated virtual environment or container under a non-privileged account.
  • Avoid sudo pip install and prevent dependency installation from accessing unnecessary credentials or sensitive directories.
  • Add the absent implementation and its complete dependency manifest to the reviewed package so documented behavior can be audited reproducibly.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: fund-analysis
version: 1.1.0
description: "Analyze mutual fund performance, holdings, risk metrics, and investment suitability"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill description and usage guidance are written only in Chinese, with no indication that users may choose another language or locale. Per the policy, a skill that effectively constrains interaction to a specific language without opt-in should be flagged unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The package description is entirely in Chinese and does not indicate that the skill supports multiple languages or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.