Great People Hedge Fund

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a stock-analysis prompt package, but its documentation can install a mismatched skill through an unpinned remote command and its trading-style outputs need stronger safety framing.

Review this carefully before installing. Prefer the `openclaw install great-people-hedge-fund` path or a pinned, verified installer command matching the metadata slug, and treat all buy/sell signals and position-size suggestions as educational analysis rather than financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:153

Finding

Unpinned Package Execution with a Mismatched Skill Identifier

Content

View full analysis

Vulnerability Details

File Location: README.md:153
Vulnerability Type: Insecure third-party dependency execution and Skill identifier mismatch
Risk Level: Medium

Vulnerable Code

bash

npx --yes clawhub@latest install great-people-hedge-fund-sms

The requested Skill identifier conflicts with the project metadata in _meta.json:3:

json

"slug": "great-people-hedge-fund"

Technical Analysis

The installation command uses npx to retrieve and execute clawhub@latest. Because latest is a mutable package tag rather than an exact reviewed version, the code executed at installation time can differ from the code available when this project was audited. No package integrity hash or signature is specified.

The --yes option automatically accepts installation prompts, reducing the opportunity for users to inspect the package version and requested actions before execution.

In addition, the command requests great-people-hedge-fund-sms, while the audited package metadata declares the slug great-people-hedge-fund. The mismatched identifier may cause the installer to retrieve a different Skill that is not represented by the files reviewed in this audit.

Attack Path

1. A user copies and runs the ClawHub installation command from README.md.
2. npx resolves the mutable clawhub@latest package from the configured npm registry.
3. The package is downloaded and executed locally without an explicit confirmation prompt because --yes is present.
4. The installer requests great-people-hedge-fund-sms, which differs from the audited project slug.
5. If either the mutable npm release or the separately identified Skill is compromised or attacker-controlled, its unreviewed installation logic runs in the user's environment.

Impact Assessment

Successful exploitation could execute arbitrary installation logic with the privileges of the user running npx. Depending on those privileges and the behavior of the retrieved packa ...[truncated 555 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed package version.
2. Verify the package through a trusted registry and provide an integrity hash or signature where supported.
3. Remove --yes so users can inspect and approve installation actions.
4. Correct the requested Skill identifier to match _meta.json:

   bash

   npx clawhub@<reviewed-exact-version> install great-people-hedge-fund
   

5. Document the expected package publisher, registry, exact version, and Skill identifier.
6. Prefer an installation workflow that does not execute remotely retrieved package code, or require users to download and inspect the installer before execution.
7. Add release verification procedures to ensure the documentation, metadata slug, and registry artifact remain consistent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute npx --yes clawhub@latest install ..., which fetches and runs remote code at install time without pinning to a specific reviewed version. If the upstream package is compromised, updated maliciously, or a dependency is hijacked, users can execute attacker-controlled code simply by following the installation instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly produces actionable buy/hold/sell investment signals and conviction scores, but provides no warning about financial risk, uncertainty, or that the output is not investment advice. In a finance context, this increases the chance that users will over-rely on speculative model output for real trading decisions, potentially causing financial harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This prompt instructs the agent to provide stock analysis, valuation, and conviction signals in an authoritative Buffett persona without any warning that the output is not financial advice. That presentation can cause users to over-trust speculative or incomplete analysis and make real financial decisions based on it, especially because the format includes investment-style signals, intrinsic value estimates, and margin-of-safety guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly formats outputs as investment signals, including bullish/bearish stance, short-candidate labeling, and a conviction score, which can be interpreted by users as actionable financial advice. Without any disclaimer, suitability warning, or requirement to ground responses in uncertainty and user context, the skill increases the risk of users making trading decisions based on authoritative-seeming but unregulated guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill is explicitly designed to provide investment-analysis output in the voice of a famous macro trader, including signals, conviction, position sizing, leverage opportunity, and timing guidance. Without a clear disclaimer and safety framing, users may treat the output as actionable financial advice, which increases the risk of harmful high-risk trading decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrase "Market情绪分析" introduces a specific non-English locale in the natural-language description. Because the document does not state that multilingual output is optional or that this skill is region-specific, this can conflict with language/locale policy expectations requiring user choice or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file consistently presents the skill description, persona, commands, and output format in both Chinese and English, suggesting a fixed bilingual locale behavior. Because the policy requires avoiding forced language or locale constraints without user opt-in or clear justification, this should offer a language preference or state why bilingual output is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L10 includes Chinese text ('细节') within otherwise English instructions. The policy allows locale or language constraints when the skill offers choice or clearly documents the reason, but this file provides neither, so it may impose mixed-language output unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.