ClawHub
Back to skill

Security audit

Economic Calendar

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward economic-calendar scraping tool with dependency hygiene issues but no evidence of hidden access, credential use, persistence, or destructive behavior.

Install in a virtual environment, pin dependency versions before production use, and verify event times against another source before using the output for trading, scheduling, or other accuracy-sensitive decisions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
beautifulsoup4>=4.11.0
pytz>=2022.1
Confidence
92% confidence
Finding
The dependency is specified with a lower bound only, which allows future, unreviewed versions to be installed and makes builds non-reproducible. This increases supply-chain risk because a later compromised or breaking release could be pulled into the skill without code changes.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
beautifulsoup4>=4.11.0
pytz>=2022.1
Confidence
92% confidence
Finding
The package is not pinned to an exact version, so installations may resolve to different releases over time. That weakens reproducibility and can introduce vulnerable or malicious upstream changes into the environment unexpectedly.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
beautifulsoup4>=4.11.0
pytz>=2022.1
Confidence
90% confidence
Finding
Using only a minimum version permits uncontrolled upgrades and reduces build determinism. While pytz is not especially high risk here by itself, unpinned dependencies still expand the attack surface for supply-chain issues and compatibility problems.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The requirements file allows installation of requests from version 2.28.0 upward, and static analysis indicates the package has multiple published advisories. Because the constraint does not exclude known-affected versions, deployments may install a vulnerable release, potentially enabling issues such as credential leakage or TLS/request-validation weaknesses depending on runtime usage.

Static analysis

No suspicious patterns detected.