ClawHub
Back to skill

Security audit

Tecent Finance 1

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to provide a finance CLI, but the executable it tells users to run is not included, so its real behavior cannot be reviewed.

Review this package carefully before installing. Do not obtain a replacement tfin executable from an unspecified source or place it in /usr/local/bin unless you can verify its provenance and contents. Prefer a user-local or virtual-environment install with pinned, reviewed dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:126
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126-133
Vulnerability Type: Unpinned and integrity-unverified dependencies
Risk Level: Medium

Vulnerable Code:

markdown
## Requirements

- Python 3.7+
- requests
- rich

```bash
pip3 install requests rich
text

### Technical Analysis

The installation command retrieves mutable versions of `requests` and `rich` from the user's configured Python package index. No exact versions, cryptographic hashes, lockfile, or trusted index URL are specified.

Python package installation can execute package-controlled build or installation logic. Consequently, a compromised package release, malicious package-index mirror, dependency substitution, or unsafe index configuration could introduce code that was not reviewed with this skill.

The named packages are legitimate and there is no evidence that they are currently malicious. The issue is the absence of controls that guarantee reproducible and integrity-verified dependency resolution.

### Attack Path

1. An attacker compromises a dependency release, transitive dependency, or package-index endpoint, or influences the user's pip index configuration.
2. The user follows the documented `pip3 install requests rich` instruction.
3. Pip resolves and downloads the attacker-controlled package version.
4. Malicious package logic executes during installation, import, or subsequent CLI use.
5. The payload operates with the privileges of the account running pip.

### Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's account. This may expose files, environment variables, application credentials, and network resources accessible to that account. If the installation command is run with elevated privileges, the impact could extend to system-wide modification, although elevated execution is not instructed by the artifact.
Remediation
View remediation

Remediation Suggestions

  • Pin every direct and transitive dependency to a reviewed version.
  • Provide a lockfile or requirements file containing cryptographic hashes.
  • Use an integrity-enforcing installation command such as pip install --require-hashes -r requirements.txt.
  • Explicitly document the trusted package index rather than relying on potentially unsafe user or system pip configuration.
  • Install dependencies inside a dedicated virtual environment with least-privilege permissions.
  • Add automated dependency vulnerability and provenance checks to the release process.

other

Warning
Location
SKILL.md:19
Finding

Missing and Unverifiable Referenced Executable

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-22
Vulnerability Type: Incomplete or unverifiable packaged artifact
Risk Level: Medium

Vulnerable Code:

markdown
```bash
chmod +x /path/to/skills/tencent-finance/tfin
ln -sf /path/to/skills/tencent-finance/tfin /usr/local/bin/tfin  # Optional: global access
text

### Technical Analysis

The audited artifact contains only `SKILL.md` and `_meta.json`; the referenced `tfin` executable is absent. Its implementation, network destinations, command construction, input validation, data handling, and claimed Tencent Finance API behavior therefore cannot be audited.

The instructions encourage the user to make an externally obtained file executable and optionally expose it through `/usr/local/bin/tfin`. If a different or attacker-controlled file is placed at the documented path, invocations of the legitimate-looking `tfin` command will execute that unaudited file. The symlink operation does not independently grant additional privileges and may require existing administrative permission, but it can make the substituted executable globally discoverable when performed by an authorized operator.

### Attack Path

1. The user discovers that the documented `tfin` executable is missing from the package.
2. The user obtains or accepts a same-named executable from an external or untrusted source, or an attacker places a file at the documented path.
3. The user marks that file executable as instructed.
4. If the user has sufficient permission, the file is linked into `/usr/local/bin/tfin`.
5. The user or another account invokes `tfin`, causing the unaudited executable to run under the invoking account's privileges.

### Impact Assessment

The immediate confirmed impact is that the package is incomplete and its advertised functionality cannot be verified. If an attacker supplies the missing executable, arbitrary code could run with the privileges of each invo
...[truncated 199 chars]
Remediation
View remediation

Remediation Suggestions

  • Include the complete tfin source code or executable in the published artifact.
  • Provide cryptographic checksums, signatures, provenance information, and reproducible build instructions.
  • Ensure documentation never directs users to obtain an unspecified replacement executable.
  • Prefer installation into a project-specific virtual environment or user-local binary directory.
  • Avoid global symlink creation by default and clearly document any permissions required.
  • Audit the executable's network requests, input validation, subprocess use, and handling of financial data before release.
  • Add packaging tests that fail publication when a documented executable is absent.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.