T03 · Remote Payload Retrieval and Execution
Warning
- Location
README.md:47- Finding
Mutable Remote Skill Package Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Tech Earnings Deep Dive
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed financial-analysis prompt package, with no code execution or persistence, but users should be aware that its activation wording and README install URL are broad.
Install only from the reviewed ClawHub package or a pinned, trusted release rather than the README's raw main-branch URL. Treat outputs as research support, not financial advice, and override the skill when you want a narrower answer or a different language.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description uses mandatory language like '务必使用此技能' and explicitly expands to broad, common investing prompts, which can override normal routing judgment and cause the agent to invoke this skill for many loosely related requests. In a financial-analysis context, this creates prompt-scope hijacking risk: the skill can dominate conversations, suppress better-matched tools, and steer outputs into a prescribed workflow even when the user asked for something narrower or different.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims it should activate for a very wide range of earnings, valuation, and portfolio-decision questions without defining clear exclusion criteria or precedence rules. In a multi-skill environment, this can cause unintended invocation, overshadow more appropriate skills, and steer user interactions into investment-analysis workflows when the user intent is only loosely related.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger examples are expansive and only show positive matches, which encourages over-triggering because there are no counterexamples showing when the skill should stay inactive. That ambiguity can be exploited by ordinary phrasing to force this skill into contexts like generic investing discussion, portfolio management, or comparisons better handled by other tools.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Stating that the skill 'automatically activates' on 'relevant topics' is underspecified and leaves the activation boundary entirely subjective. Subjective routing logic increases the chance of accidental or excessive invocation, which can distort tool selection and make the system easier to prompt-route in unintended ways.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The English trigger description mirrors the same overbreadth as the Chinese section, broadening the risk across multilingual interactions. Because it covers many common investing prompts, it increases the probability that the skill captures traffic outside its intended earnings deep-dive scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The English use-case examples are broad and do not define exclusions, so they function like permissive routing patterns rather than scoped examples. In practice, this can cause the skill to activate for routine investing questions that lack earnings-specific intent, leading to misrouting and unnecessary influence over responses.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The phrase that the skill activates automatically when it detects 'relevant topics' is ambiguous and effectively delegates routing to an undefined heuristic. Undefined heuristics are dangerous in agent ecosystems because they enable prompt collisions, overreach into adjacent domains, and unreliable skill selection behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill metadata and description are written to enforce Chinese-language behavior without checking the user's language preference, which can cause the agent to respond in an unexpected language or degrade accessibility and instruction alignment. In practice this is a control-flow and user-intent issue: it may override the user's preferred language, reduce transparency in a high-stakes financial context, and make outputs less reviewable by some users.
- Content