stock-price-checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:41 AM UTC
• Version: 1.0.0

Overview

The stock lookup logic is simple and purpose-aligned, but the included shell launcher runs an unreviewed hard-coded script path outside the package.

Before installing, treat the Python script itself as low-risk for ordinary stock lookups, but avoid relying on the bundled stock-price.sh launcher unless it is changed to execute the packaged stock-price.py relative to its own directory. Verify dependencies come from the expected Python environment.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: stock-price.sh:4

Finding

Hard-Coded External Script Path Creates Local Tool Hijacking Risk

Content

View full analysis

Vulnerability Details

File Location: stock-price.sh, line 4
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: Medium

Vulnerable Code:

bash

python3 /home/clawdbot/clawd/skills/stock-price-checker/stock-price.py "$@"

Technical Analysis

The shell launcher does not execute the audited stock-price.py located in the same project directory. Instead, it invokes a Python file at a hard-coded external filesystem path:

/home/clawdbot/clawd/skills/stock-price-checker/stock-price.py

The contents of that external file may differ from the script included in this package. This breaks the package integrity boundary and creates a local tool-hijacking opportunity: another user, process, installer, or compromised component with write access to the target file or one of its parent directories could replace the referenced script.

Argument forwarding itself is safely quoted through "$@"; the finding is specifically the unsafe reliance on code outside the reviewed package.

Attack Path

1. An attacker obtains write access to the hard-coded script path, or can create the referenced path before deployment.
2. The attacker places a malicious stock-price.py at that location.
3. A user invokes the bundled stock-price.sh, expecting it to run the reviewed project script.
4. The launcher starts Python with the attacker-controlled external file.
5. The malicious code executes with the invoking user's privileges.

Exploitation requires filesystem write access to the referenced file or a relevant parent directory. The reviewed project contains no code that grants such access and no malicious replacement payload was identified.

Impact Assessment

Successful exploitation permits arbitrary Python code execution under the account that launches stock-price.sh. The attacker could access files and credentials available to that account, modify user-owned data, make network requests, or ex ...[truncated 146 chars]

Remediation

View remediation

Remediation Suggestions

Resolve the Python script relative to the launcher's own directory and replace the shell process with Python:

bash

#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
exec python3 "$SCRIPT_DIR/stock-price.py" "$@"

Additionally:

• Package and deploy the launcher and Python script together.
• Ensure the package directory and files are not writable by untrusted users.
• If a fixed installation path is operationally required, verify ownership and permissions before execution and use deployment-time integrity verification.
• Add a test confirming that the launcher executes the adjacent audited script rather than an external copy.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.