Stock-Decision
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill’s stock-analysis purpose is clear, but its scripts build shell commands from user-controlled stock inputs, which could allow a crafted input to run unintended local commands.
Review this skill before installing. Its financial-analysis behavior is disclosed and it does not appear to trade or modify accounts, but the current scripts should be fixed to avoid running shell commands built from user input. Use only with trusted stock inputs and trusted local dependencies.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A maliciously crafted stock name or code could cause unintended commands to run on the local machine when the skill is invoked.
The stock input is derived from the user and is interpolated into a shell command with `shell=True`; a crafted quote or shell metacharacter could make the agent execute commands outside the intended stock lookup.
cmd = f"node ~/.workbuddy/skills/westock-data/scripts/index.js search '{self.stock_input}'"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)Replace shell-string execution with argument arrays and `shell=False`, validate stock symbols strictly, and avoid passing raw user text to Bash. If shell execution is unavoidable, use robust escaping such as `shlex.quote` and add explicit user confirmation for non-stock commands.
The result depends on local tools and another installed skill that are not part of this review, so their behavior and provenance affect safety and accuracy.
The skill relies on local Python/Node execution and another skill, `westock-data`, even though the registry metadata lists no required binaries or install spec. This is disclosed and purpose-aligned, but users should verify the dependency source.
node ~/.workbuddy/skills/westock-data/scripts/index.js search <股票名称或代码> python ~/.workbuddy/skills/stock-decision/scripts/analyze.py <股票名称或代码>
Declare runtime requirements and the westock-data dependency in metadata, and install only trusted versions of the dependent tools and skills.