ClawHub
Back to skill

Security audit

Investing

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed investing helper, but one included budget script can execute unintended shell commands if given a crafted input.

Review before installing. The market-price script is ordinary public API polling, but do not run monthly-dca.sh with budget values from untrusted text or agent-generated input unless the script is fixed to accept only bounded numeric amounts. Treat all investing and tax content as general guidance, not personalized financial advice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
monthly-dca.sh:3
Finding

Arbitrary Command Execution Through Unvalidated Bash Arithmetic Input

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi if (( BUDGET > 100000000 )); then printf 'Error: budget exceeds the supported maximum.\n' >&2 exit 1 fi ``` Additional hardening measures: 1. Define an appropriate lower and upper bound based on the legitimate financial use case. 2. Reject signs, whitespace, decimal points, variable names, brackets, parentheses, and other arithmetic syntax. 3. Use a validated internal variable for all calculations rather than reusing raw input. 4. Add tests confirming rejection of array syntax, command substitutions, malformed numbers, negative values, and excessively large integers. 5. Consider performing calculations with a language or utility that parses input strictly as numeric data if decimal currency values must be supported. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill includes executable shell scripts and operational instructions to run them, but it does not declare any explicit tool scope or allowed tools. This creates an authorization and transparency gap: a host agent may expose shell execution more broadly than intended, and users cannot easily assess what capabilities the skill expects to use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
echo "VWCE (All-World):  €$VWCE"

# Bitcoin
BTC=$(curl -s "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=eur" 2>/dev/null | jq -r '.bitcoin.eur // "N/A"')
echo "Bitcoin (BTC):     €$BTC"

# Ethereum

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · check-etf-prices.sh (reported line 11)May include surrounding context.

sh
echo "VWCE (All-World):  €$VWCE"

# Bitcoin
BTC=$(curl -s "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=eur" 2>/dev/null | jq -r '.bitcoin.eur // "N/A"')
echo "Bitcoin (BTC):     €$BTC"

# Ethereum

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · check-etf-prices.sh (reported line 15)May include surrounding context.

sh
echo "VWCE (All-World):  €$VWCE"

# Bitcoin
BTC=$(curl -s "https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=eur" 2>/dev/null | jq -r '.bitcoin.eur // "N/A"')
echo "Bitcoin (BTC):     €$BTC"

# Ethereum

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states the skill is for 'Lithuanian investors,' which imposes a locale-specific constraint in the skill's natural-language behavior. The file does not indicate any user opt-in, language/locale selection, or justification as a region-locked compliance requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.