Finance Watcher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:02 PM UTC
• Version: 1.0.0

Overview

This finance-monitoring CLI appears purpose-aligned and not malicious, but it needs Review because its networked Node package includes flagged vulnerable HTTP dependencies.

Review before installing. The skill does not show credential theft, hidden persistence, or trading/account mutation, but it contacts third-party market-data services and stores your watchlist locally. Ask the publisher to patch and pin the flagged HTTP dependencies and clarify that webhook integrations are not included in the reviewed code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A second description-behavior mismatch is present: the skill claims broad monitoring, alerts, portfolio management, and report generation, but the available artifact does not substantiate those features. In security terms, overstated capabilities can mask supply-chain risk by encouraging execution of an external package that reviewers cannot validate from the skill content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: A second description-behavior mismatch is present: the skill claims broad monitoring, alerts, portfolio management, and report generation, but the available artifact does not substantiate those features. In security terms, overstated capabilities can mask supply-chain risk by encouraging execution of an external package that reviewers cannot validate from the skill content.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The lockfile pins axios to 1.13.5, and the provided advisory set includes multiple high-severity issues affecting request handling, proxy behavior, and prototype-pollution-related attack paths. In a finance-monitoring skill that fetches external market data, an HTTP client vulnerability is especially relevant because untrusted network responses and proxy settings are part of normal operation, increasing exposure to SSRF, credential leakage, or response tampering.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: form-data 4.0.5 is flagged for CRLF injection through unescaped multipart field names and filenames, which can enable request smuggling or header/body manipulation in crafted multipart submissions. Even if this skill primarily reads market data, the dependency is present through axios and could become exploitable if any feature uploads files or forwards user-controlled multipart content now or in future updates.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The dependency tree resolves axios to a version with multiple known advisories, including issues associated with SSRF and man-in-the-middle/prototype-pollution exploitation paths. Because this skill is intended to monitor financial prices and likely makes outbound HTTP requests, a vulnerable HTTP client is especially risky and could expose network access, credentials, or response integrity.

External Transmission

Medium

• Category: Data Exfiltration

Content

class CryptoAPI {
  constructor() {
    this.baseURL = 'https://api.coingecko.com/api/v3';
    this.timeout = 10000;
  }

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The code forces the date locale to 'zh-CN' and emits fixed Chinese headings and labels in the generated report. This is a natural-language/locale policy concern because users are not offered a language or locale choice, and no justification for the restriction appears in the file.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The markdown promotes external data sources and webhook integrations without warning users that the skill performs network access and may send data to third-party services. While common for finance tools, omitting these disclosures reduces informed consent and can lead to unexpected outbound connections or leakage of portfolio/watchlist information.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: follow-redirects 1.15.11 is reported as leaking custom authentication headers across cross-domain redirects. Because axios depends on this package and the skill likely performs outbound requests to price/data providers, a malicious or compromised upstream endpoint could redirect requests and cause sensitive headers or tokens to be sent to an unintended domain.

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: This manifest file only describes the skill as "Stock and crypto price monitoring with alerts and daily reports," but does not specify concrete trigger phrases, invocation constraints, or exclusion conditions. In a manifest context, that broad description can make it unclear when the skill should activate versus when general finance-related conversation should not invoke it.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "Claw",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "chalk": "^4.1.2"
  }

• Confidence: 93% confidence
• Finding: Using a caret range for axios allows newer minor/patch releases to be installed without explicit review, which can unexpectedly introduce vulnerable or breaking versions through the supply chain. In a finance-monitoring skill that likely performs network requests, dependency integrity matters because compromised or risky updates could affect data handling and outbound connections.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "chalk": "^4.1.2"
  }
}

• Confidence: 88% confidence
• Finding: Using a caret range for commander permits silent dependency drift, which increases supply-chain risk by allowing unreviewed updates into builds. Although commander is not obviously security-sensitive here, broad version ranges still reduce reproducibility and make incident response harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "chalk": "^4.1.2"
  }
}

• Confidence: 88% confidence
• Finding: Using a caret range for chalk introduces unnecessary supply-chain exposure because future compatible releases can be pulled in automatically. The direct impact is limited since chalk is typically used for terminal formatting, but exact pinning is still safer for reproducibility and trust.