Yfinance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:09 PM UTC
• Version: 0.1.2

Overview

This finance-data skill is not clearly malicious, but its installer can run mutable remote code and make persistent local configuration changes that users should review first.

Install only after reviewing and pinning the exact MCP server source, replacing curl | sh with a verified uv installation method, removing or constraining repository and path overrides, and confirming any mcporter or OpenClaw skill-directory writes. Run it as an unprivileged user and avoid YFINANCE_YES=true unless the target paths are known and backed up.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:84

Finding

Unverified Remote Installer Executed Directly by Shell

Content

View full analysis

&1 if [ -f "$HOME/.local/bin/uv" ]; then UV_BIN="$HOME/.local/bin/uv" elif [ -f "/root/.local/bin/uv" ]; then UV_BIN="/root/.local/bin/uv" else error "Failed to install uv. Install manually: https://docs.astral.sh/uv/" exit 1 fi success "uv installed at $UV_BIN" fi ``` The same unsafe installation pattern is presented in the manual instructions: ```bash # 2. Install uv curl -LsSf https://astral.sh/uv/install.sh | sh # 3. Create venv + install uv venv .venv --python 3.12 uv pip install -e . --python .venv/bin/python ``` ### Technical Analysis The installer sends a mutable HTTPS response directly to `sh`. The downloaded content is neither displayed for review nor validated using a pinned cryptographic checksum, release signature, or immutable artifact version. Although `astral.sh` is presented as the official source for uv, the trustworthiness of the expected operator does not eliminate the vulnerability inherent in executing a mutable network response. A compromise of the hosting account, distribution infrastructure, DNS or TLS trust chain, or upstream installation script would convert the installer into an arbitrary code-execution channel. Redirect handling is enabled through `curl -L`, so the final script may also originate from another endpoint. The command executes with all permissions of the user running `install.sh`. Given the default `/root/clawd` path and explicit `/root/.local/bin/uv` handling, the installer may reasonably be run as root, substantially increasing the potential impact. This behavior exceeds minimum privilege. Installing a Python package does not require executing an ...[truncated 1096 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:12

Finding

Unpinned and Overrideable Remote Repository Is Installed and Executed

Content

View full analysis

/dev/null; then error "git is required to clone the repository." exit 1 fi CLONE_DIR="$PROJECT_DIR/yfinance-mcp-server" if [ -f "$CLONE_DIR/pyproject.toml" ]; then info "Using existing clone at $CLONE_DIR" else git clone "$REPO_URL" "$CLONE_DIR" 2>&1 fi PROJECT_DIR="$CLONE_DIR" if [ -z "${YFINANCE_VENV_DIR:-}" ]; then VENV_DIR="$PROJECT_DIR/.venv" fi success "Project bootstrapped at $PROJECT_DIR" fi ``` ```bash info "Installing yfinance-mcp-server + dependencies..." "$UV_BIN" pip install -e "$PROJECT_DIR" --python "$VENV_DIR/bin/python" 2>&1 | tail -5 success "Package installed" # Verify entry point if [ -f "$VENV_DIR/bin/yfin-mcp" ]; then success "Entry point: $VENV_DIR/bin/yfin-mcp" else error "Entry point yfin-mcp not found in $VENV_DIR/bin/" exit 1 fi # Verify tools load info "Verifying tools load..." TOOL_COUNT=$("$VENV_DIR/bin/python" -c " from yfinance_mcp.server import mcp print(len(mcp._tool_manager._tools)) " 2>&1) ``` ### Technical Analysis The reviewed artifact contains only `SKILL.md` and `install.sh`; it does not contain the advertised MCP server implementation or its dependency manifest. When `pyproject.toml` is absent, the installer clones a remote repository and immediately p ...[truncated 2255 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:187

Finding

Environment-Controlled Paths Are Interpolated into Python Source Code

Content

View full analysis

&1 success "mcporter config updated" ``` ```bash # Add yfinance to config python3 -c " import json config = json.load(open('$MCPORTER_CONFIG')) if 'mcpServers' not in config: config['mcpServers'] = {} config['mcpServers']['yfinance'] = { 'command': '$VENV_DIR/bin/yfin-mcp' } json.dump(config, open('$MCPORTER_CONFIG', 'w'), indent=2) print('Added') " 2>&1 success "yfinance added to mcporter config" ``` ### Technical Analysis `MCPORTER_CONFIG` and `VENV_DIR` are influenced by the `MCPORTER_CONFIG` and `YFINANCE_VENV_DIR` environment variables. Their values are expanded by the shell directly into the source text passed to `python3 -c`. Shell quoting of the outer command does not make these values safe Python literals. A value containing a single quote followed by valid Python syntax can terminate the intended string and insert arbitrary Python statements. For example, a malicious configuration path could contain Python syntax that closes `open('...')`, invokes `os.system(...)`, and comments out the remaining generated line. Exploitation requires the value to pass the preceding file checks and reach one of the configuration-update branches, but attacker-controlled local filesystem names can be constructed to satisfy those conditions. The same flaw occurs multiple times for both reading and writing the configuration and for the command path stored in the JSON document. ### Attack Path 1. An attacker or unsafe ...[truncated 1039 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:104

Finding

Unrestricted Environment-Controlled Recursive Directory Deletion

Content

View full analysis

&1 | awk '{print $2}') info "Existing venv found (Python $EXISTING_VER)" if [ "$AUTO_YES" = "true" ]; then response="y" else read -r -p " Recreate venv? [y/N] " response fi if [[ "$response" =~ ^[Yy]$ ]]; then rm -rf "$VENV_DIR" info "Removed old venv" else info "Keeping existing venv" fi fi ``` The deletion target originates from an environment-controlled value: ```bash VENV_DIR="${YFINANCE_VENV_DIR:-$PROJECT_DIR/.venv}" AUTO_YES="${YFINANCE_YES:-false}" ``` ### Technical Analysis Quoting `"$VENV_DIR"` prevents shell word splitting and option injection, but it does not establish that the directory is safe to delete. The path can be selected through `YFINANCE_VENV_DIR`. The only safeguards are that the target must be a directory and must contain a file named `bin/python`. Those conditions do not prove that the target is a dedicated virtual environment owned by this project. A system directory, application directory, shared environment, or other valuable directory may satisfy them. When `YFINANCE_YES=true`, the installer automatically approves recreation and executes `rm -rf` without an interactive confirmation. No canonicalization, project-boundary check, root-path rejection, mount-point check, ownership check, or virtual-environment marker validation is performed. ### Attack Path 1. An attacker, deployment configuration, or operator mistake sets `YFINANCE_VENV_DIR` to a valuable existing directory that contains `bin/python`. 2. `YFINANCE_YES=true` is also set, or the user approves the misleading “Recreate venv?” prompt. 3. The installer observes the directory a ...[truncated 748 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is only Yahoo Finance data access, but the document also instructs cloning remote code, fetching and executing an installer, creating environments, installing packages, modifying mcporter configuration, and copying files into the skills directory. This description-behavior mismatch is dangerous because users may trust a benign-seeming data skill while overlooking supply-chain, persistence, and local-configuration modification risks.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

7. ✅ Install `SKILL.md` to OpenClaw skills directory

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using a pipeline from curl to sh creates immediate execution of unreviewed remote content and removes any meaningful inspection barrier. In the context of a skill that otherwise looks like a simple finance-data integration, this makes the installation path substantially more dangerous by enabling one-step arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

cd yfinance-mcp-server

# 2. Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 3. Create venv + install
uv venv .venv --python 3.12

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises finance-data access, but its installation and setup instructions require shell execution and local file writes while the skill metadata does not declare any tool scope or permissions boundaries. This makes the operational footprint less transparent and increases the chance that an agent or user will permit broader capabilities than expected.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

5. Install skill

mkdir -p ${CLAWD_DIR}/skills/yfinance cp SKILL.md ${CLAWD_DIR}/skills/yfinance/SKILL.md

text

### Verify

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script downloads and immediately executes a remote shell script via curl | sh, which creates a direct remote code execution path if the upstream server, network path, or DNS is compromised. This is especially dangerous in an install script because it may be run with elevated privileges and without users reviewing the fetched content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

In non-interactive mode, the script can automatically delete and recreate the virtual environment without an additional runtime warning. While this is common in installers, it is still a real safety issue because it can destroy local state or overwrite expected paths if environment variables are misconfigured or attacker-controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

When AUTO_YES is enabled, the script can modify mcporter configuration automatically, changing command paths or inserting a new server entry without an interactive confirmation. This can silently alter execution behavior for future tool invocations, and if variables like VENV_DIR or MCPORTER_CONFIG are manipulated, it may redirect mcporter to an unintended executable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The installation section states that the installer will automatically modify mcporter config and install the skill file, but it does not prominently warn that local files will be changed. Even if intended for convenience, silent or underexplained persistence/config writes can surprise users and reduce informed consent around system changes.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The manual install instructs users to download and execute a remote install script directly from the network. This is dangerous because compromise of the upstream host, DNS/TLS interception, or an unexpected script change could lead to arbitrary code execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

cd yfinance-mcp-server

# 2. Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh

# 3. Create venv + install
uv venv .venv --python 3.12

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line is the concrete instance of fetching and executing a remote installer script in one step. In the context of an agent skill installer, this is more dangerous because installation scripts are often trusted and may run in sensitive environments, making supply-chain compromise or transparent code injection especially impactful.

Content

Scanner excerpt · install.sh (reported line 90)May include surrounding context.

sh

success "uv found at $UV_BIN"
else
    info "Installing uv..."
    curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1
    if [ -f "$HOME/.local/bin/uv" ]; then
        UV_BIN="$HOME/.local/bin/uv"
    elif [ -f "/root/.local/bin/uv" ]; then

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script creates the destination directory and copies SKILL.md and README.md into it as part of the install flow. While these actions are consistent with installation, there is no explicit advance disclosure that files under the OpenClaw skills directory will be created or overwritten if they already exist.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.