FinClaw

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:40 AM UTC
• Version: 1.0.0

Overview

FinClaw is a coherent finance helper that stores local portfolio data and uses known market-data APIs, with no evidence of hidden execution, exfiltration, or destructive behavior outside its stated purpose.

Install only if you are comfortable with a Python environment pulling current package versions, local storage of portfolio records and notes, and market queries being sent to third-party finance APIs. Use limited-scope API keys, avoid putting sensitive notes in symbols/watchlists, and be careful with remove/delete commands because some local records are deleted rather than archived.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("Installing dependencies...")
    subprocess.check_call([VENV_PIP, "install", "--upgrade", "pip"],
                          stdout=subprocess.DEVNULL)
    subprocess.check_call([VENV_PIP, "install", "-r", REQ_FILE])
    print("Dependencies installed.")

• Confidence: 82% confidence
• Finding: Installing dependencies from requirements.txt during setup introduces a meaningful supply-chain risk because any malicious, compromised, or unpinned dependency will be executed in the local environment. In the context of an AI finance skill, users may run setup on systems holding API keys, brokerage credentials, or market data secrets, increasing the damage from a compromised package.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The portfolio, alerts, and watchlist commands perform persistent state changes such as add, sell, remove, create, delete, and snooze, but the markdown does not warn that these operations modify stored user data. In an agent setting, this increases the chance of unintended destructive actions or silent data loss if the model invokes commands without clear user confirmation.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill documents optional API keys and several third-party market, news, macro, and sentiment providers, but it does not disclose that user-requested symbols, watchlist contents, or query parameters may be transmitted to external services. While the transmitted data is usually low sensitivity in a finance context, the omission can still mislead users about privacy and data handling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The remove_position function permanently deletes both the position record and all associated transactions immediately after receiving a symbol, with no confirmation, dry-run, soft-delete, or authorization guard. In an agentic finance assistant context, a mistaken invocation, ambiguous user prompt, or unsafe tool chaining could irreversibly erase portfolio history and impair auditability, portfolio tracking, and tax/cost-basis reconstruction.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This code sends user-supplied symbols or topics to Alpha Vantage over the network without any explicit user-facing notice or consent mechanism. While the destination is a legitimate finance API and the data is not highly sensitive by itself, queries can still reveal user interests, trading intent, or portfolio focus, creating a privacy leak.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance
pandas
matplotlib
mplfinance

• Confidence: 98% confidence
• Finding: The dependency yfinance is unpinned, so installs may resolve to different versions over time. This creates supply-chain risk and can unexpectedly introduce breaking changes or newly introduced vulnerabilities into the skill environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance
pandas
matplotlib
mplfinance
finnhub-python

• Confidence: 99% confidence
• Finding: The dependency pandas is unpinned, which allows arbitrary newer versions to be installed during deployment. In a finance assistant handling external data, this increases supply-chain and stability risk because vulnerable or incompatible releases may be pulled in without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance
pandas
matplotlib
mplfinance
finnhub-python
requests

• Confidence: 98% confidence
• Finding: matplotlib is unpinned, so the runtime may install whatever version is current at resolution time. That weakens reproducibility and can expose the environment to newly introduced package flaws or ecosystem compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yfinance
pandas
matplotlib
mplfinance
finnhub-python
requests
fredapi

• Confidence: 98% confidence
• Finding: mplfinance is unpinned, which means builds are not deterministic and may silently consume changed upstream code. This is a classic software supply-chain weakness even if no specific exploit is present in the file itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
matplotlib
mplfinance
finnhub-python
requests
fredapi

• Confidence: 98% confidence
• Finding: finnhub-python is unpinned, allowing deployments to drift across versions. Because this package interfaces with external financial APIs, an unexpected version change could alter request behavior, dependency trees, or introduce vulnerable code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

matplotlib
mplfinance
finnhub-python
requests
fredapi

• Confidence: 99% confidence
• Finding: requests is unpinned, which is more concerning than many other libraries because it is a core HTTP client exposed to untrusted remote endpoints. Unpinned network-facing dependencies can silently introduce versions with known security issues or behavior changes that affect transport security, credential handling, or request validation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mplfinance
finnhub-python
requests
fredapi

• Confidence: 97% confidence
• Finding: fredapi is unpinned, creating non-reproducible builds and avoidable supply-chain exposure. Even if the package itself is not presently flagged, leaving it floating increases the chance of unintentionally adopting risky upstream changes.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: requirements.txt includes requests without a version pin, and the scanner reports multiple known advisories affecting some requests versions, including credential leakage and verification-related issues. Because this skill is a finance assistant that likely makes outbound HTTP calls to market and macroeconomic data sources, a vulnerable requests version could expose secrets, mishandle redirects or authentication, or weaken transport security when interacting with attacker-controlled or compromised endpoints.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.