AI Hedge Fund

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.2.0

Overview

The skill appears intended for stock-analysis simulation, but it asks users to install mutable third-party code into the system Python environment and reads OpenClaw session configuration for model selection.

Install only if you are comfortable running code from the current upstream GitHub repository and modifying the Python environment. Prefer a pinned reviewed commit, a virtual environment or container, explicit --model selection, and non-sensitive prompts or approved LLM providers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Source and Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-19
Vulnerability Type: Unpinned third-party dependencies and mutable source installation
Risk Level: Medium

bash

# Clone project
git clone https://github.com/virattt/ai-hedge-fund /data/workspace/ai-hedge-fund

# Install
pip install -e /data/workspace/ai-hedge-fund --break-system-packages --quiet
pip install yfinance --break-system-packages --quiet

Technical Analysis

The documented setup clones the mutable default branch of an external Git repository and installs it without pinning a reviewed commit. It also installs yfinance without a fixed version or package hash. Consequently, the code installed by these commands can change after the Skill has been reviewed.

Python package installation can execute package build hooks and other installation logic. If the upstream repository, its maintainer account, the package distribution channel, or a selected dependency release is compromised, attacker-controlled code could execute during installation. The --break-system-packages option further weakens environment isolation by allowing pip to modify a system-managed Python installation.

No malicious code was confirmed in the audited local files. The vulnerability is the unsafe and non-reproducible dependency acquisition process documented by the Skill.

Attack Path

1. An attacker compromises the upstream Git repository, package publisher account, or relevant distribution infrastructure.
2. The attacker adds malicious installation or runtime code to the repository’s default branch or publishes a malicious package version.
3. A user follows the setup instructions in SKILL.md.
4. git clone retrieves the current, unreviewed upstream content, while pip selects the current unpinned package release and dependencies.
5. Pip executes attacker-controlled build or installation logic, or installs code that executes when the Skill later launches t ...[truncated 647 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the external Git repository to a specific reviewed commit hash and verify that hash before installation.
2. Pin yfinance and all transitive dependencies to reviewed versions using a lock file.
3. Require package hashes, such as through pip install --require-hashes, to prevent substitution of package artifacts.
4. Install dependencies in a dedicated virtual environment or isolated container rather than the system Python environment.
5. Remove --break-system-packages from the documented commands.
6. Review package build metadata and installation hooks before approving dependency updates.
7. Automate dependency provenance, vulnerability, and integrity checks in the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs users to clone a repository, install packages, and run Python scripts, but it declares no tool scope or allowed-tools metadata. In an agent environment, this can lead to unintended shell/code execution capability exposure because the runtime cannot enforce a least-privilege boundary for a skill that clearly needs shell access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises support for external models and auto-detects model configuration, but it does not warn users that stock prompts, reasoning, and related context may be transmitted to third-party LLM providers. This creates a data disclosure risk, especially if users include proprietary trading ideas, account context, or other sensitive information in prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill reads the user's OpenClaw session configuration from a fixed path under /root/.openclaw to auto-detect the active model, which accesses host/session data unrelated to stock analysis itself. Even if the immediate use is limited to model selection, this establishes unnecessary access to potentially sensitive local configuration and couples the skill to privileged user context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest frames the skill as running an AI-powered hedge fund simulation, but this file achieves that by invoking a separate interpreter process on another script. Spawning subprocesses is a broader execution capability that is not mentioned in the skill description and is not inherently required by the stated purpose at this wrapper level.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run.py (reported line 70)May include surrounding context.

python

cmd.extend(["--initial-cash", args.initial_cash])
    
    result = subprocess.run(cmd)
    sys.exit(result.returncode)

if __name__ == "__main__":

Static analysis

No suspicious patterns detected.