ClawHub
Back to skill

Security audit

Options Flow Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OptionWhales API client that reads an API key from the environment and fetches market data without persistence or unrelated local access.

Install only if you intend to use OptionWhales and are comfortable giving the skill access to your OPTIONWHALES_API_KEY for authenticated API calls. Treat outputs as market data signals, not trading instructions, and avoid wiring it into automated trading or alerts without your own controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 29, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url = f"{BASE_URL}{endpoint}"
    req = urllib.request.Request(url, headers={"X-API-Key": API_KEY})
    try:
        with urllib.request.urlopen(req, timeout=15) as resp:
            return json.loads(resp.read().decode())
    except Exception as e:
        print(f"ERROR: Failed to fetch {endpoint}: {e}")
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding
This skill depends on live requests to a third-party API, but that network capability is not covered by declared permissions. In an agent ecosystem, undeclared network behavior is risky because it can bypass user expectations and governance controls, especially when combined with secret-bearing authentication headers.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding
This skill depends on live requests to a third-party API, but that network capability is not covered by declared permissions. In an agent ecosystem, undeclared network behavior is risky because it can bypass user expectations and governance controls, especially when combined with secret-bearing authentication headers.

External Transmission

Medium
Category
Data Exfiltration
Content
from datetime import datetime

API_KEY = os.environ.get("OPTIONWHALES_API_KEY", "")
BASE_URL = "https://api.optionwhales.com/v1"


def fetch_json(endpoint: str) -> dict:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low
Confidence
98% confidence
Finding
The module docstring states it fetches 'Historical flow for trend analysis', suggesting a capability beyond current snapshots. No function or command in the file accesses any historical endpoint or exposes trend-analysis behavior; all implemented endpoints are current flow, ticker flow, momentum rankings, and current abnormal trades.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The inline documentation explicitly says the script fetches 'Historical flow for trend analysis', but the executable code contains no historical-flow function, command, or endpoint call. This is an intent-code divergence because the documentation describes a concrete supported behavior that the implementation does not perform.

Static analysis

No suspicious patterns detected.