ClawHub
Back to skill

Security audit

Pilot Financial Trading Desk Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent trading-desk setup guide, but it enables high-impact trade execution workflows with weak scoping and safety warnings.

Review this carefully before installing. Use only in a sandbox or paper-trading environment until every dependency is pinned and verified, peer handshakes are manually checked, exchange credentials are least-privilege, and independent order limits or human approval gates are enforced.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:48
Finding

Unpinned Third-Party Skills Introduce Supply-Chain Risk

Content
View full analysis
-analyst # On sentiment scanning server clawhub install pilot-stream-data pilot-event-filter pilot-archive pilotctl set-hostname -sentiment # On risk management server clawhub install pilot-event-filter pilot-audit-log pilot-alert pilotctl set-hostname -risk-mgr # On execution server clawhub install pilot-task-router pilot-receipt pilot-webhook-bridge pilotctl set-hostname -executor ``` ### Technical Analysis The setup installs multiple registry-hosted skills without immutable versions, integrity hashes, cryptographic signatures, source repository references, or explicit publisher-verification instructions. Consequently, the code installed at deployment time may differ from the code originally reviewed. The source code of these dependencies is not included in this project, so their behavior cannot be validated as part of this audit. The exposure is particularly significant for `pilot-webhook-bridge`, which is described as interfacing with exchange APIs for order placement, and for the executor role, which is intended to process approved trades. This does not establish that any named dependency is currently malicious. The vulnerability is the absenc ...[truncated 1896 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The documentation states that trust is 'auto-approved' once both sides exchange handshakes, with no manual verification step or secondary identity check. In a multi-agent system that can route approved trades to an execution component, automatic trust establishment increases the chance of misbinding to the wrong peer, trusting a spoofed hostname, or expanding authority without adequate operator review.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash
# analyst <-> risk-mgr (trade signals)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README includes end-to-end examples for approving and executing trades, including quantities, order type, and fill reporting, without any warning that these workflows may connect to real exchange integrations. In the context of a trading-execution skill, users could reasonably test these commands against production-configured agents and trigger unintended live orders or believe the workflow is safe for experimentation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

clawhub install pilot-task-router pilot-receipt pilot-webhook-bridge

text

**Step 3:** Set the hostname and write the manifest to `~/.pilot/setups/financial-trading-desk.json`.

**Step 4:** Tell the user to initiate handshakes with the peers for their role.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill orchestrates an executor role that interfaces with exchange APIs and includes example commands for publishing approved trades, but it does not clearly warn the user that this workflow can result in real order placement and financial loss if connected to live venues. In a trading skill, omission of an explicit high-visibility warning increases the chance of unsafe deployment, especially when users may mistake examples for sandbox-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.