ClawHub
Back to skill

Security audit

SEC 13F Whale Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does the advertised SEC 13F reporting, but it unconditionally disables proxy environment settings before making network requests, which can bypass managed network controls.

Install only if you are comfortable with the tracker making direct HTTPS requests to SEC services and bypassing proxy environment settings inside its process. In managed or audited networks, require removal of the proxy-clearing code or an explicit opt-in direct mode. Pin the requests dependency before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/requirements.txt:1
Finding

Unpinned and Unverified Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1; installation instructions at SKILL.md:13-16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

scripts/requirements.txt:1:

text
requests>=2.28.0

SKILL.md:13-16:

bash
cd /tmp && python3 -m venv sec13f-venv
source sec13f-venv/bin/activate
pip install -r "$SKILL_DIR/scripts/requirements.txt"

Technical Analysis

The dependency specification uses an open-ended >= version constraint. Consequently, future installations may resolve to any later release of requests, including a version that was not available or reviewed when this skill was audited. The installation instructions also do not use a lock file, package hashes, or pip's --require-hashes integrity enforcement.

The package name is legitimate, and no evidence indicates that the currently available package is malicious. The weakness is the absence of reproducible version selection and artifact verification, which expands the software supply-chain trust boundary beyond the audited project.

Attack Path

  1. An attacker compromises an allowed future release or its package-distribution path.
  2. A user follows the documented setup instructions.
  3. Pip resolves the open-ended requirement to the compromised release.
  4. Package-controlled code may execute during installation or later when requests is imported.
  5. That code runs with the permissions of the user executing the setup or tracker.

This path requires compromise of the dependency supply chain or delivery infrastructure; the project itself does not retrieve or execute an independent remote payload.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the privileges of the user running pip or the tracker. This may permit access to files, environment variables, and network resources available to that user. The scope does not inherently include privilege escalation ...[truncated 29 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests to an exact, reviewed version rather than using an open-ended lower bound.
  2. Generate a reproducible lock file containing all transitive dependencies.
  3. Record verified SHA-256 hashes and install with pip's hash enforcement:
bash
python3 -m pip install --require-hashes -r scripts/requirements.txt
  1. Use a requirements entry in the following form:
text
requests==<reviewed-version> --hash=sha256:<verified-hash>
  1. Review and deliberately update the pinned version and hashes through a controlled dependency-update process.
  2. Run dependency vulnerability and provenance checks in CI before accepting upgrades.

other

Warning
Location
scripts/tracker.py:18
Finding

Unconditional Removal of User-Configured Proxy Controls

Content
View full analysis

Vulnerability Details

File Location: scripts/tracker.py:18-20
Vulnerability Type: other: Network Security Control Bypass
Risk Level: Medium

Vulnerable Code

python
# Clear proxy env vars that may interfere with direct connections
for _proxy_var in ["ALL_PROXY", "all_proxy", "HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"]:
    os.environ.pop(_proxy_var, None)

Technical Analysis

The script unconditionally removes all common HTTP, HTTPS, and general proxy environment variables before performing network requests. Proxy settings can represent mandatory organizational egress filtering, audit logging, TLS inspection, privacy routing, or the only permitted network route.

Direct access to SEC endpoints does not require globally mutating the process environment. Removing these values without explicit user consent violates the caller's network-routing expectations and may cause all later HTTP operations in the same process to bypass configured controls.

The mutation is limited to the current process and any child processes it subsequently launches; it does not persistently alter the parent shell or system configuration. The reviewed script does not launch child processes, which limits the current scope.

Attack Path

  1. A user or administrator configures HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY to enforce monitored or restricted outbound traffic.
  2. The tracker starts and removes those values from its process environment.
  3. The tracker sends requests directly to its hard-coded SEC HTTPS endpoints rather than through the configured proxy.
  4. Expected proxy-based monitoring, policy enforcement, or routing is bypassed for those requests.

The endpoints observed in the audited code are hard-coded official sec.gov HTTPS services; no suspicious external destination was identified.

Impact Assessment

The behavior may bypass expected network monitoring and egress controls, disclose the host's direct source address to S ...[truncated 226 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the environment-variable deletion and respect caller-provided proxy settings by default.
  2. If direct connectivity is required for a specific deployment, provide an explicit, documented opt-in command-line option.
  3. Scope any opt-out to a dedicated requests.Session rather than modifying the process environment:
python
session = requests.Session()
session.trust_env = not args.direct
  1. Display a clear warning before bypassing configured proxies and record the selected network mode in logs.
  2. In managed environments, allow administrators to prohibit direct mode through configuration.
  3. Test both proxy-routed and direct operation without silently changing user settings.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares no explicit tool scope even though its documented workflow requires network access, environment interaction, and file writes. Missing scope is a real security issue because it prevents least-privilege enforcement and makes it harder for a host system or reviewer to constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Clearing proxy environment variables can bypass organizational monitoring, egress controls, or mandated routing, which exceeds the normal needs of a 13F analysis skill. In this context, the capability is more dangerous because the skill only needs standard outbound HTTPS to a public SEC endpoint and has no obvious legitimate need to defeat proxy settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This is a natural-language policy issue because the file states it will generate reports in Chinese, and the rest of the script consistently emits Chinese output. There is no opt-in, language selection mechanism, or documented reason that the skill must be Chinese-only, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script unconditionally removes proxy-related environment variables for the entire process before making outbound requests. That bypasses enterprise egress controls, monitoring, DLP, or security tooling that may rely on configured proxies, which is outside the stated need of a 13F tracking skill and can weaken network governance.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tracker.py (reported line 33)May include surrounding context.

python
EDGAR_FULL_TEXT = "https://efts.sec.gov/LATEST/search-index"

# SEC EDGAR API endpoints
SUBMISSIONS_URL = "https://data.sec.gov/submissions/CIK{cik}.json"
FILING_INDEX_URL = "https://www.sec.gov/Archives/edgar/data/{cik_int}/{accession}/"

USER_AGENT = "OpenClaw Research Tool research@openclaw.com"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest presents the skill as an analytics/reporting tool over SEC 13F data, but the implementation also saves fetched holdings snapshots to the local data directory for reuse. Persisting raw fund holdings data is more than a transient implementation detail because it creates durable local state not reflected in the stated behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

While the manifest says the skill generates analysis reports, the code specifically persists those reports to the local filesystem in the reports directory, including a stable latest.md pointer. That durable write behavior is a meaningful operational capability beyond merely generating a report response.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation states the skill fetches SEC filings and generates reports, but it also discloses behavior that clears proxy environment variables. That is a meaningful hidden capability because it changes the network execution environment in a way users and operators would not expect from the stated purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows any future release to be installed, including versions with breaking changes or newly introduced security issues. This weakens build reproducibility and makes it impossible to verify at review time which exact package version will be deployed.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

Because the manifest does not pin requests to a specific reviewed version, it is not possible to determine whether installation will resolve to a release affected by known advisories. In a skill that fetches remote SEC EDGAR data over HTTP(S), the HTTP client library is security-relevant, so ambiguity around its version increases supply-chain and transport-related risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.