ClawHub
Back to skill

Security audit

Microsoft Qlib

Security checks for vulnerabilities and agentic risk

Overview

The skill is for a legitimate finance library, but its install command appears to install a different PyPI package than Microsoft Qlib.

Review before installing. If you intend to use Microsoft Qlib, verify and install the official package name (`pyqlib`) in a virtual environment rather than accepting this skill's `qlib` install command. Treat any data downloads or stock-price retrieval as network activity subject to your licensing and compliance rules.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill advertises fetching stock prices and using Qlib data features, but it does not warn users that these operations may require external network access and may interact with third-party data sources. In an agent setting, missing disclosure can lead to unexpected outbound connections, privacy/compliance issues, or execution in restricted environments where network access should be explicit.

Static analysis

No suspicious patterns detected.