Security audit

Charts

Security checks for vulnerabilities and agentic risk

Overview

This chart skill mostly matches its stated purpose, but it directs generated files to a fixed Telegram account and depends on unreviewed local Python code.

Review before installing. Use this only if you control the ~/clawd/crypto_charts.py module and intend to use that exact Telegram recipient. Prefer removing the Telegram send instruction or requiring explicit confirmation and destination selection before any file is transmitted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:95
Finding: Generated Charts Are Directed to a Hardcoded Telegram Recipient
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:14
Finding: Execution Depends on an Unbundled Module Loaded from a User-Writable Directory
Content: View full analysis
&1 ``` Single-chart command: ```bash cd ~/clawd && python3 -c " import os, json from crypto_charts import ( fetch_yfinance, fetch_ohlc, fetch_market_data, calc_moving_averages, calc_rsi, calc_fibonacci, detect_patterns, generate_chart, COINS ) coin_id = 'COIN_ID' # bitcoin, ethereum, ripple, sui, gold, silver info = COINS[coin_id] # Fetch data (Yahoo Finance first, CoinGecko fallback) df = fetch_yfinance(coin_id) if df is None or len(df) < 10: df = fetch_ohlc(coin_id) if df is None or len(df) < 10: df = fetch_market_data(coin_id) if df is not None and len(df) >= 5: df = calc_moving_averages(df) df = calc_rsi(df) fib = calc_fibonacci(df) patterns = detect_patterns(df) chart_path = os.path.expanduser(f'~/clawd/charts/chart_{info[\"symbol\"].lower()}.png') generate_chart(coin_id, df, fib, chart_path) print(f'Chart: {chart_path}') print(f'Price: \${df[\"close\"].iloc[-1]:,.2f}') print(f'RSI: {df[\"rsi\"].iloc[-1]:.1f}') print('Patterns:') for p in patterns: print(f' - {p}') else: print('Not enough data to generate chart') " ``` ### Technical Analysis The audited project contains only `SKILL.md` and `_meta.json`; it does not include the referenced `crypto_charts.py` implementation. Both commands first change the working directory to `~/clawd` and then import `crypto_charts`. Python places the working directory on its module search path. Consequently, importing `crypto_charts` executes the top- ...[truncated 2365 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes an instruction to send generated artifacts to a hard-coded Telegram target without any consent, verification, or warning about external transmission. This creates a clear exfiltration path: even if the chart itself seems harmless, attached files and surrounding context may disclose user activity, analysis targets, or locally generated outputs to an external recipient.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation guidance is broad enough to trigger on generic market-analysis or reporting requests, which can cause the skill to run in contexts the user did not explicitly intend. Over-broad invocation increases the chance of unnecessary code execution, external data fetching, and unintended follow-on actions such as chart generation for routine conversations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.