Stock Analysis 6.2.0

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:37 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stock-analysis purpose, but its Twitter features ask users to expose live X session cookies and pass broad environment secrets to an external CLI.

Review before installing. Use --no-social for hot scans unless you are comfortable giving a third-party CLI access to X session credentials, avoid granting Terminal Full Disk Access, do not place unrelated secrets in the skill .env, and treat portfolio/watchlist files as sensitive local financial data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/hot_scanner.py:22

Finding

Hot Scanner exposes the complete process environment to a network-capable third-party executable

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/rumor_scanner.py:33

Finding

Rumor Scanner exposes the complete process environment to the Twitter CLI

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/hot_scanner.py:364

Finding

Unpinned globally installed Twitter dependency receives live session credentials

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: docs/HOT_SCANNER.md:132

Finding

Documentation recommends granting Terminal unnecessary Full Disk Access

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/portfolio.py:111

Finding

Portfolio and watchlist financial data are stored without explicit restrictive permissions

Content

View full analysis

Path: """Get the portfolio storage path.""" # Use ~/.clawdbot/skills/stock-analysis/portfolios.json state_dir = os.environ.get("CLAWDBOT_STATE_DIR", os.path.expanduser("~/.clawdbot")) portfolio_dir = Path(state_dir) / "skills" / "stock-analysis" portfolio_dir.mkdir(parents=True, exist_ok=True) return portfolio_dir / "portfolios.json" ``` Portfolio write using a predictable temporary path: ```python self.path.parent.mkdir(parents=True, exist_ok=True) # Atomic write: write to temp file, then rename tmp_path = self.path.with_suffix(".tmp") try: with open(tmp_path, "w", encoding="utf-8") as f: json.dump(self._data, f, indent=2) tmp_path.replace(self.path) ``` Watchlist storage: ```python def ensure_dirs(): """Create storage directories.""" WATCHLIST_DIR.mkdir(parents=True, exist_ok=True) ``` ```python def save_watchlist(items: list[WatchlistItem]): """Save watchlist to file.""" ensure_dirs() data = [asdict(item) for item in items] WATCHLIST_FILE.write_text(json.dumps(data, indent=2)) ``` ### Technical Analysis Portfolio files contain asset identifiers, quantities, cost bases, and timestamps. Watchlist files can contain target prices, stop prices, signal preferences, and user notes. This is sensitive financial and behavioral information. The code relies on the process umask to determine directory and file permissions. In a permissive or shared environment, the resulting files may be readable by other local users. The portfolio implementation also uses a predictable `.tmp` filename without explicitly protecting its permissions. The storage is plaintext, a ...[truncated 1167 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (55)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 114)May include surrounding context.

md

GET  /portfolios
   POST /portfolios
   PUT  /portfolios/{id}
   DELETE /portfolios/{id}

   GET  /portfolios/{id}/assets
   POST /portfolios/{id}/assets

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 119)May include surrounding context.

md

GET  /portfolios/{id}/assets
   POST /portfolios/{id}/assets
   PUT  /portfolios/{id}/assets/{ticker}
   DELETE /portfolios/{id}/assets/{ticker}

   GET  /portfolios/{id}/performance?period=weekly
   GET  /portfolios/{id}/summary

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 126)May include surrounding context.

md

GET  /alerts
   POST /alerts
   DELETE /alerts/{id}

   GET  /user/subscription
   POST /user/subscription/upgrade

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description claims a large set of capabilities and trusted data-source expectations, while the documented behavior appears inconsistent and includes undeclared external sources. This is dangerous because users and orchestrators may make trust decisions based on inaccurate declarations, leading to unexpected data exfiltration, network access, or automation behavior outside the stated scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description claims a large set of capabilities and trusted data-source expectations, while the documented behavior appears inconsistent and includes undeclared external sources. This is dangerous because users and orchestrators may make trust decisions based on inaccurate declarations, leading to unexpected data exfiltration, network access, or automation behavior outside the stated scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description claims a large set of capabilities and trusted data-source expectations, while the documented behavior appears inconsistent and includes undeclared external sources. This is dangerous because users and orchestrators may make trust decisions based on inaccurate declarations, leading to unexpected data exfiltration, network access, or automation behavior outside the stated scope.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · TODO.md (reported line 88)May include surrounding context.

md

- [ ] Add timeout per indicator (10s max)
- [ ] Test with multiple stocks in sequence
- [ ] Measure actual runtime improvement
- [ ] Update SKILL.md with new runtime (target: 3-4s)

**Expected Impact**:
- Reduce runtime from 6-10s to 3-4s per stock

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · TODO.md (reported line 193)May include surrounding context.

md

- [ ] Add timeout per indicator (10s max)
- [ ] Test with multiple stocks in sequence
- [ ] Measure actual runtime improvement
- [ ] Update SKILL.md with new runtime (target: 3-4s)

**Expected Impact**:
- Reduce runtime from 6-10s to 3-4s per stock

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The .env example directs users to place active Twitter/X authentication tokens in a file within the skill directory, creating a concrete pathway for sensitive credential exposure through source control, backups, logs, or accidental file sharing. Because these values are session tokens rather than low-privilege API keys, compromise could allow unauthorized access to the associated X account until revoked or expired.

Content

Scanner excerpt · docs/HOT_SCANNER.md (reported line 149)May include surrounding context.

Create .env file in the skill directory:

bash

# /path/to/stock-analysis/.env
AUTH_TOKEN=your_auth_token_here
CT0=your_ct0_token_here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The code explicitly targets a .env file and imports its contents, which commonly contain API keys, tokens, or credentials. While loading secrets is sometimes legitimate, here it creates unnecessary credential exposure because the script later runs an external program with inherited environment state.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 22)May include surrounding context.

python

from collections import defaultdict
from concurrent.futures import ThreadPoolExecutor, as_completed

# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
    with open(ENV_FILE) as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Opening and parsing a project-level .env file is credential-access behavior that increases risk when combined with later subprocess execution. The danger is contextual: a market scanner does not need broad access to all local secrets, so this exceeds least-privilege expectations.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 23)May include surrounding context.

python

from concurrent.futures import ThreadPoolExecutor, as_completed

# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
    with open(ENV_FILE) as f:
        for line in f:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Copying the entire environment is a form of secret harvesting because it collects all available environment variables, including credentials unrelated to this feature. In this file, that harvested data is immediately provided to an external subprocess, making accidental or malicious exfiltration much more plausible.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 387)May include surrounding context.

python

for category, query in searches:
                try:
                    env = os.environ.copy()
                    result = subprocess.run(
                        [bird_bin, "search", query, "-n", "15", "--json"],
                        capture_output=True, text=True, timeout=30, env=env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Referencing a repository-local .env for runtime secrets is not inherently malicious, but in this script it supports external CLI authentication and broad environment propagation. That creates a real credential-handling risk because secrets are pulled from disk and made available to another executable without strict controls.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 30)May include surrounding context.

python

# Bird CLI path
BIRD_CLI = "/home/clawdbot/.nvm/versions/node/v24.12.0/bin/bird"
BIRD_ENV = Path(__file__).parent.parent / ".env"

def load_env():
    """Load environment variables from .env file."""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The .env parsing logic reads every key/value pair and places it into os.environ, which is later inherited by the Bird CLI. This broad secret access is dangerous because it exceeds least privilege and can expose credentials unrelated to rumor scanning.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 33)May include surrounding context.

python

BIRD_ENV = Path(__file__).parent.parent / ".env"

def load_env():
    """Load environment variables from .env file."""
    if BIRD_ENV.exists():
        for line in BIRD_ENV.read_text().splitlines():
            if '=' in line and not line.startswith('#'):

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

Copying the full environment and passing it to an external CLI can leak unrelated secrets, tokens, and service credentials into a child process that does not need them. In a tool-running agent environment, this broad inheritance substantially increases blast radius if the CLI is compromised, logs its environment, or forwards telemetry.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 79)May include surrounding context.

python

for query in queries[:4]:  # Limit to avoid rate limits
        try:
            cmd = [BIRD_CLI, 'search', query, '-n', '10', '--json']
            env = os.environ.copy()
            
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This second occurrence repeats the same risky pattern of forwarding the entire environment to an external binary. Because the skill context already includes local .env ingestion, the combination makes credential overexposure more dangerous than ordinary environment inheritance.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 132)May include surrounding context.

python

for query in queries[:3]:
        try:
            cmd = [BIRD_CLI, 'search', query, '-n', '15', '--json']
            env = os.environ.copy()
            
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a stock and crypto analysis skill with portfolio/watchlist features, but this document proposes transforming it into a commercial mobile product with backend services, authentication, cloud infrastructure, and monetization. Those are materially broader product behaviors than an analysis skill and represent a semantic scope expansion rather than an implementation detail.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Stripe integration, webhook handling, subscription tier changes, and in-app purchase flows are commercial billing capabilities, not direct requirements of stock or crypto analysis. The manifest does not state any billing or payment-processing purpose, so this capability is contextually outside the justified scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The roadmap includes Mixpanel/Amplitude and Sentry for analytics and error tracking but does not mention any user-facing disclosure, consent flow, or privacy controls tied to that telemetry. In a retail-investor app handling account, portfolio, and behavioral data, undisclosed tracking can lead to privacy violations, regulatory exposure, and accidental leakage of sensitive user information into third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to extract AUTH_TOKEN and CT0 cookies from browser DevTools and store them in a .env file, which are effectively session credentials for the user's X account. This encourages insecure handling of sensitive authentication material and increases the risk of account takeover if the tokens are exposed through shell history, logs, backups, repo commits, or weak local file protections.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises shell, network, filesystem, and environment-dependent behavior through documented commands and metadata, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because a host agent may grant broader capabilities than users expect, making command execution, network access, and local file writes occur without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to place Twitter/X authentication material in a local .env file but does not include any warning about secret sensitivity, storage hygiene, or accidental disclosure. This is dangerous because users may store live session tokens insecurely, commit them to source control, or expose them to other tools, enabling account takeover or unauthorized API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs users to obtain Twitter/X session credentials from browser cookies and store them in a local .env file or environment variables, but it does not clearly warn that these are highly sensitive session tokens that can grant account access. In the context of an agent skill that may be run, shared, or automated, encouraging manual extraction and storage of live auth tokens increases the risk of credential theft, accidental disclosure, or account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage guide shows portfolio creation, adding holdings, and watchlist modification commands without clearly warning that they persist and mutate local user data. In an agent-driven context, users may assume these are read-only analysis examples and unintentionally create, alter, or overwrite portfolio/watchlist state, leading to integrity issues, privacy exposure, or confusion in downstream automation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and CLI description frame this script as 'Stock analysis using Yahoo Finance data' and 'Analyze stocks using Yahoo Finance data'. In practice, the code also fetches Google News RSS for breaking news and uses EDGAR/SEC Form 4 filings for insider trading sentiment, which are materially different data sources and broaden the behavior beyond the stated Yahoo Finance scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.