ClawHub
Back to skill

Security audit

stock-market-dashboard

Security checks for vulnerabilities and agentic risk

Overview

The skill’s market-data access and dashboard generation fit its purpose, with precautions needed for file sharing and persistent widgets.

Prefer an attachment or pasted HTML. If using local serving, restrict it to the generated file, bind to loopback and stop it after delivery; the host’s server defaults are unspecified. Pin the widget only if you want it to survive resets and be replaced on later runs. Keep the API key out of the HTML, and expect requested ticker symbols to reach SentiSense. Separate onboarding and host widget implementations were not included in this artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

The delivery workflow permits a local HTTP server despite restricting network access to HTTPS requests to app.sentisense.ai.

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The delivery fallback introduces an HTTP listener outside the declared HTTPS-only network permissions without specifying its bind address, served directory, access controls, or shutdown procedure. Depending on the agent's implementation and host networking, this could expose the dashboard or other files in the served directory to unintended clients; the temporary file-delivery purpose reduces suspicion but does not prevent that exposure.

Content

No source excerpt is available for this finding.

The widget delivery instructions introduce persistent dashboard-state writes beyond the declared single-file output.

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

L034 authorizes writing one user-named HTML file, whereas L373–L377 instruct the agent to pin a widget into persistent session-dashboard state and replace that state on subsequent runs. This is a separate persistent write operation, not merely rendering or delivering the permitted file.

Content

No source excerpt is available for this finding.