ClawHub
Back to skill

Security audit

Tecent Finance

Security checks for vulnerabilities and agentic risk

Overview

This is a simple stock-quote skill, but the package only contains documentation and would need cautious manual setup to be useful.

Install only in a virtual environment, avoid running pip or symlink commands with elevated privileges, and verify the missing tfin implementation before relying on it for financial information.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:134
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 134-140
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Requirements

- Python 3.7+
- requests
- rich

```bash
pip3 install requests rich
text

### Technical Analysis

The documented installation command installs `requests` and `rich` without pinned versions, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, package selection depends on the package index and resolver configuration present when a user runs the command.

This prevents reproducible dependency verification and creates supply-chain exposure. If a future package release, transitive dependency, configured package mirror, or index account is compromised, users following the instructions could install attacker-controlled code. Python packages can execute code during installation under some build configurations and can execute arbitrary code when imported or invoked by the CLI.

The project only contains `SKILL.md`; the referenced `tfin` implementation and dependency metadata are absent. Therefore, the exact dependency versions, transitive dependency graph, import behavior, and runtime network behavior cannot be independently validated from the audited artifact.

### Attack Path

1. An attacker compromises a dependency release, one of its transitive dependencies, a package publisher account, or the package index/mirror configured in the victim's environment.
2. The attacker publishes or serves a malicious package version that still satisfies the unrestricted dependency names.
3. A user follows the documentation and runs `pip3 install requests rich`.
4. `pip3` resolves and downloads the attacker-controlled package because no reviewed version or hash is enforced.
5. Malicious code executes during an applicable build or installation process, or later when the installed pa
...[truncated 729 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the unrestricted installation command with a reviewed requirements or lock file containing exact versions for all direct and transitive dependencies.

  2. Record cryptographic hashes and require verification during installation, for example:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Generate and review the dependency lock file using a controlled build process, and update it through a documented dependency-review workflow.

  4. Explicitly configure and document a trusted package index rather than relying on ambient pip configuration or untrusted mirrors.

  5. Add automated dependency vulnerability and integrity scanning to the release process.

  6. Include the missing tfin implementation and dependency metadata in the project so reviewers can verify imports, API endpoints, transitive dependencies, and runtime behavior.

  7. Recommend installation in an isolated virtual environment under a non-privileged account rather than into a system-wide Python environment.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.