Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Public.com brokerage integration, but it handles live trading authority, brokerage secrets, runtime package installation, and options automation in ways users should review carefully before installing.
Install only if you are comfortable granting an agent access to a real brokerage account that can view balances and place or cancel trades. Configure credentials outside chat if possible, verify API permissions are least-privilege, preinstall dependencies in a controlled environment, and require explicit human approval for every live order, cancellation, or options strategy action.
scripts/get_option_chain.py:8Automatic Runtime Installation of a Security-Sensitive Third-Party Dependency
SKILL.md:41Brokerage API Secret Is Requested Through Conversation and Embedded in a Command Argument
This code is clearly related to Public.com brokerage functionality, so the resource/domain is consistent. However, the declared description promises a broad account interaction skill including portfolio viewing, quotes, trade placement, and account updates. The actual code chunk only supports a single, narrower capability: preflight estimation of an order’s cost and buying-power impact. A preflight calculation is not the same as placing a trade. Because the implemented behavior is materially narrower than the declared purpose and omits the main listed capabilities, this is a description-behavior mismatch for this supplied code chunk.
The file materially expands the skill from basic brokerage account interaction into a broad options-strategy automation library, including strategy selection logic and automated execution patterns. In a trading skill, this increases the chance that users or downstream agents invoke complex, high-risk behavior that was not clearly disclosed or constrained by the manifest, leading to unauthorized or unexpectedly risky trading actions.
The document presents order automation examples for real brokerage APIs without prominent warnings that these examples can place live trades and cause real financial loss. In this context, examples may be copied directly into production-like agent workflows, making accidental execution of risky strategies more likely.
The short-option strategy sections describe positions with assignment risk, leverage, and potentially large or asymmetric loss exposure, but do not provide explicit cautionary controls or suitability warnings. In a brokerage skill, omitting those warnings can normalize dangerous strategies and encourage unsophisticated or automated use of instruments with severe downside.
The event-driven engines and looping wheel workflow enable systematic trade initiation without clear per-trade user authorization, bounded runtime, or kill-switch behavior. In a brokerage context, unattended autonomous execution can rapidly accumulate positions, amplify losses, and continue acting on stale signals or changed market conditions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"""
Get PUBLIC_COM_SECRET from secure file or environment.
Tries in order:
1. ~/.openclaw/workspace/.secrets/public_com_secret.txt
2. PUBLIC_COM_SECRET environment variable
Returns the secret string or None if not found.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"""
Get PUBLIC_COM_SECRET from secure file or environment.
Tries in order:
1. ~/.openclaw/workspace/.secrets/public_com_secret.txt
2. PUBLIC_COM_SECRET environment variable
Returns the secret string or None if not found.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"""
Get PUBLIC_COM_SECRET from secure file or environment.
Tries in order:
1. ~/.openclaw/workspace/.secrets/public_com_secret.txt
2. PUBLIC_COM_SECRET environment variable
Returns the secret string or None if not found.
The script submits live brokerage orders immediately after argument parsing with no final confirmation, preview, or dry-run safeguard. In the context of an agent skill capable of trading, this greatly increases the risk of accidental or manipulated order execution, potentially leading to immediate financial loss.
The skill declares shell, file-read, and environment-dependent behavior but does not constrain tool scope with explicit permissions or allowed-tools. In an agent setting, that broad implicit capability increases the chance of unintended command execution, secret access, or unsafe file reads beyond the user’s expected brokerage workflow.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
id: public-dot-com
name: public.com
description: Interact with your Public.com brokerage account using the Public.com API. Able to view portfolio, get stock quotes, place trades, and get account updates. To create a Public.com account head to public.com/signup.
env: ['PUBLIC_COM_SECRET', 'PUBLIC_COM_ACCOUNT_ID']
license: Apache-2.0
metadata:
The skill supports placing and canceling live orders in a brokerage account but lacks a strong, high-visibility warning that these actions affect real funds and positions. In this context, insufficient warning and confirmation can lead to accidental real-money trades, financial loss, or unintended position changes.
The skill instructs the agent to provide options strategy recommendations and automation guidance beyond simple account management. In a real-money brokerage context, this broadens the skill into high-risk financial decision support, potentially nudging users toward complex trades without sufficient guardrails, suitability checks, or explicit risk controls.
The wheel example uses an infinite loop that can keep opening new positions as conditions change, without explicit operator supervision or stop conditions beyond strategy logic. In a live brokerage environment, this can lead to unattended repeated execution, runaway exposure, and trading beyond the user's intent.
The file introduces external event-ingestion, volatility screening, and basket-ordering logic that goes beyond simple account interaction and increases operational complexity and attack surface. In practice, such screening workflows can trigger repeated trades across multiple symbols based on unvalidated data or brittle models, causing widespread unintended execution.
The volatility-arbitrage example iterates across a symbol universe and places repeated option orders without an explicit warning about unattended bulk execution, slippage, or aggregate portfolio risk. In a brokerage setting, batched autonomous order placement can magnify model errors and operational mistakes across many positions very quickly.
Auto-installing a package during execution is risky because it allows external code retrieval and installation as part of a brokerage workflow. In a financial-account skill, introducing dynamic package installation increases trust and supply-chain risk, especially when handling API secrets and account operations.
The script installs a package at runtime via pip, which introduces an uncontrolled code-execution path during normal use. Even though the package version is pinned, runtime dependency installation expands the attack surface through package-index, environment, and supply-chain risks and is unnecessary in a trading-related action path.
from public_api_sdk.auth_config import ApiKeyAuthConfig
except ImportError:
print("Installing required dependency: publicdotcom-py...")
subprocess.check_call([sys.executable, "-m", "pip", "install", "publicdotcom-py==0.1.8"])
from public_api_sdk import PublicApiClient, PublicApiClientConfiguration
from public_api_sdk.auth_config import ApiKeyAuthConfig
The manifest says the skill can view portfolios, get stock quotes, place trades, and get account updates. This script performs a distinct brokerage action—cancelling an existing order—which changes account state but is not mentioned in that stated scope.
The script performs a destructive financial action immediately once invoked, without any confirmation, preview, or secondary validation. In a brokerage context, accidental or unauthorized cancellation of orders can materially affect trading outcomes, making this more dangerous than a typical CRUD action.
Installing a Python package during execution is not necessary for viewing brokerage account data and introduces unnecessary capability beyond the skill's core purpose. In a financial-account skill, this is more concerning because the code handles API secrets and account access, so any dependency-fetching step expands the attack surface for supply-chain compromise or unexpected code execution.
The script automatically changes the runtime environment by installing a package without asking the user or clearly warning that it will do so. That behavior is risky because it can surprise operators, bypass change-control expectations, and trigger execution of newly downloaded code on a system that may also store sensitive brokerage credentials.
The script invokes pip at runtime to install a package, which executes an external package-management operation and modifies the host environment during normal skill execution. Even though the command is hardcoded and uses no shell, this still creates supply-chain and environment-integrity risk because execution now depends on live package retrieval and installation behavior rather than a pre-vetted dependency set.
from public_api_sdk.auth_config import ApiKeyAuthConfig
except ImportError:
print("Installing required dependency: publicdotcom-py...")
subprocess.check_call([sys.executable, "-m", "pip", "install", "publicdotcom-py==0.1.8"])
from public_api_sdk import PublicApiClient, PublicApiClientConfiguration
from public_api_sdk.auth_config import ApiKeyAuthConfig
Installing a Python package at runtime is a real supply-chain risk because the script fetches and executes third-party code during normal operation. In a brokerage skill that handles account secrets and financial history, this is more dangerous because a compromised package or index response could execute in a sensitive environment.
The script installs a package automatically without obtaining explicit user confirmation, which can surprise operators and cause network access and code execution they did not authorize. This is especially concerning in financial tooling, where users reasonably expect deterministic local behavior rather than silent environment modification.
No suspicious patterns detected.