A Share Dashboard

• Analyzed: Apr 1, 2026, 11:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4f9c74c21be887c60a3efeabdc5e750f9f390aa5353f6f65d4d394ad4681a8f4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill uses 'subprocess.run' in 'app.py' to execute a hardcoded Python script located in a different skill's directory ('/home/c1/.openclaw/workspace/skills/a-share-stock-dossier/scripts/a_share_snapshot.py'). This cross-skill dependency and the use of shell execution for data retrieval are risky patterns. Additionally, the 'fetch_via_script' function is vulnerable to argument injection because user-provided stock codes are passed directly as command-line arguments without sanitization, which could be used to alter the behavior of the underlying script.