ClawHub
Back to skill

Security audit

投资组合监控

Security checks for vulnerabilities and agentic risk

Overview

This portfolio monitor mostly does what it says, but its install instructions modify the host Python environment in an unsafe, under-scoped way.

Review before installing. Use a virtual environment and pinned dependencies instead of the provided --break-system-packages command, and be aware the script reads and writes portfolio data under a hard-coded OpenClaw memory path. Do not treat its output as financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 11
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
pip3 install yfinance --break-system-packages

Technical Analysis

The documented installation command retrieves yfinance without pinning an exact version or verifying package hashes. Consequently, the package and its transitive dependencies can change after the Skill has been reviewed.

The --break-system-packages option deliberately bypasses protections for externally managed Python environments. This can modify a host-level Python installation, introduce dependency conflicts, or replace packages used by other applications. Python packages may also execute installation or build-related code, so a compromised package release or transitive dependency could run code with the permissions of the user invoking pip3.

No evidence indicates that the current yfinance package is malicious. The vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

  1. An attacker compromises a future yfinance release, one of its transitive dependencies, or the relevant package distribution account.
  2. The user follows the Quick Start instructions and runs the unpinned pip3 install command.
  3. pip3 resolves the then-current dependency versions rather than a previously audited set.
  4. Malicious installation or runtime code executes with the invoking user's permissions.
  5. Because system package protections were bypassed, the installation may also modify or disrupt packages shared with unrelated host applications.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running the installation command. This may permit access to that user's files, environment variables, credentials, and network resources. It could also alter the shared Python environment and affect othe ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create and use a dedicated virtual environment instead of modifying the system Python installation:
    bash
    python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  2. Remove --break-system-packages from all installation instructions.
  3. Pin yfinance and every transitive dependency to reviewed, exact versions.
  4. Record cryptographic hashes in a lock file or hash-checked requirements file and install with --require-hashes.
  5. Use a controlled package index where practical and review dependency updates before adoption.
  6. Run dependency vulnerability and provenance checks in CI whenever the lock file changes.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

代码的核心确实与投资组合监控相关，并且支持港股、美股及加密货币的价格获取与盈亏计算，这与描述大体方向一致。但描述中多个能力被表述为已支持：管理持仓、设置价格提醒、生成组合报告。实际代码只实现了读取本地持仓配置、计算收益、控制台输出以及保存简单状态；“添加持仓”和“报告”功能明确标记为待开发，提醒也只是单次运行时基于阈值打印信息，而非完整的提醒系统。因此描述比实际行为更强，存在实质性能力夸大，应判定为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill appears to read and write local files (memory/portfolio.json) but does not declare any tool scope or permissions. This creates an authorization boundary problem: reviewers and users cannot clearly see that the skill needs filesystem access, increasing the chance of unintended data exposure or modification when the skill is executed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata and all user-facing instructions are written in Chinese, and there is no indication that users may interact in another language or that the skill is intentionally limited to a Chinese-speaking/regional context. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's docstring and all user-facing messages are written in Chinese, so the skill effectively forces a specific language for its interface. There is no indication that the user can choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.