ClawHub
Back to skill

Security audit

wickworks

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for technical-indicator computation, but its setup relies on a mutable third-party Docker image and an unauthenticated service with disabled host validation.

Review before installing. Only point the skill at a Wickworks instance you trust, keep it bound to localhost unless protected by an authenticated proxy or VPN, avoid sending sensitive market data to an untrusted endpoint, and prefer a reviewed image digest or locally built source over psyb0t/wickworks:latest.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/setup.md:27
Finding

Mutable Third-Party Container Image Is Executed Without Version or Digest Pinning

Content
View full analysis
Remediation
View remediation
``` 2. Apply the same digest pinning to the Compose configuration: ```yaml services: wickworks: image: psyb0t/wickworks@sha256: ``` 3. Publish the expected digest through a trusted release channel and document how users can verify it before execution. 4. Use signed container images and enforce signature verification where supported. 5. Establish an explicit update process in which new versions and digests are reviewed before deployment. 6. Run the container with additional hardening, such as a read-only root filesystem, dropped Linux capabilities, resource limits, and a non-root user where compatible. 7. Do not mount the Docker socket, host credentials, or sensitive host directories into the container. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/setup.md:76
Finding

DNS-Rebinding Host Protection Is Disabled on an Unauthenticated Service

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# Health
curl -s "$WICKWORKS_URL/health"

# The output-path catalog (labels + descriptions; static per version — cache it)
curl -s "$WICKWORKS_URL/metadata"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
claude mcp add --transport http wickworks "$WICKWORKS_URL/mcp"

# Raw JSON-RPC (stateless — call tools/call directly)
curl -s "$WICKWORKS_URL/mcp/" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The Docker command uses psyb0t/wickworks:latest, which is tagged but not immutably pinned. Using latest allows the image contents to change over time, creating supply-chain risk: a future push could introduce vulnerable or malicious code while the setup instructions still look unchanged.

Content

No source excerpt is available for this finding.