ClawHub
Back to skill

Security audit

Vnstock Environment Setup for Python Vibe Coding

Security checks for vulnerabilities and agentic risk

Overview

This setup skill can run unverified remote installers and permanently rewrite repository and agent files, so it should be reviewed carefully before installation.

Install only after reviewing the scripts and remote sources. Prefer running diagnostics only, and avoid the sponsor curl/wget-to-bash path unless the installer is pinned and verified. Do not run the guide installer in an important repository without a separate backup, a clean Git status, and explicit approval for every file or skill it will replace.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:32
Finding

Remote Sponsor Installer Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`
**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` | ``` ```bash # Linux wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept # Mac curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept ``` ### Technical Analysis The installation instructions stream content from a mutable external URL directly into Bash. The downloaded script is not pinned to a version and is not verified using a cryptographic checksum, digital signature, or trusted release manifest. The user and Agent therefore cannot determine whether the executed content matches the content that was originally reviewed. TLS protects the connection in transit but does not protect against compromise of the hosting server, DNS or certificate infrastructure, deployment pipeline, or publisher account. The effective payload can also be replaced legitimately or maliciously after this Skill has been audited. The commands pass the sponsor API key as a command-line argument. Depending on the operating system and execution environment, command-line arguments can be exposed through process inspection, terminal logs, shell history, Agent execution logs, or monitoring systems. This behavior exceeds what is necessary for ...[truncated 1645 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup_agent_guide.py:64
Finding

Unpinned Remote Repository Can Replace Agent Instructions and Local Skills

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:31
Finding

Unpinned Requirements and Additional Package Index Create Supply-Chain Risk

Content
View full analysis
**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`
**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` | ``` ```bash pip install -r https://vnstocks.com/files/requirements.txt ``` ```bash pip install vnstock -U ``` ```powershell pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer py -m vnstock_installer ``` ### Technical Analysis The requirements file is retrieved from a mutable URL at installation time. The reviewed Skill does not establish that its entries use exact versions and cryptographic hashes. The direct `pip install vnstock -U` command deliberately resolves the newest available version rather than an audited version. The sponsor setup adds a secondary package index using `--extra-index-url`. Pip can consider candidates from all configured indices, and it does not inherently treat one index as a secure namespace owner. If package names overlap or an unintended candidate has a preferred version, package resolution may select content from an unexpected source. Package installation can execute package build backends and installation-time code. The audit does not establish that the referenced packages or server are malicious. The vulnerability is the absence of immutable dependency ...[truncated 1195 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/setup_agent_guide.py:14
Finding

Setup Script Automatically Installs System Software and Runs an Unverified Windows Executable

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/setup_agent_guide.py:36
Finding

Guide Installation Stages the Entire Workspace and Destructively Replaces Local Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims environment diagnostics and setup, but the documented workflow includes materially riskier actions such as modifying git state, fetching remote content, and overwriting local docs/skills. Misrepresenting destructive or network-active behavior reduces informed consent and can trick operators into authorizing repository changes they did not expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims environment diagnostics and setup, but the documented workflow includes materially riskier actions such as modifying git state, fetching remote content, and overwriting local docs/skills. Misrepresenting destructive or network-active behavior reduces informed consent and can trick operators into authorizing repository changes they did not expect.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The Linux variant using wget piped to bash has the same remote-code-execution and supply-chain risks as the curl variant. Because it is embedded in the quick-reference table, it normalizes a highly dangerous pattern as a standard install command.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
| **3. Create Venv (Win)**| `py -m venv $env:USERPROFILE\.venv; & "$env:USERPROFILE\.venv\Scripts\Activate.ps1"` |
| **4. Install Dependencies**| `pip install -r https://vnstocks.com/files/requirements.txt` |
| **5. Free Tier Setup** | `pip install vnstock -U` |
| **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` |
| **7. Agent Guide Install** | **Mac/Linux:** `python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite`<br>**Win:** `py .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite` |

---

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The Linux variant using wget piped to bash has the same remote-code-execution and supply-chain risks as the curl variant. Because it is embedded in the quick-reference table, it normalizes a highly dangerous pattern as a standard install command.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
| **3. Create Venv (Win)**| `py -m venv $env:USERPROFILE\.venv; & "$env:USERPROFILE\.venv\Scripts\Activate.ps1"` |
| **4. Install Dependencies**| `pip install -r https://vnstocks.com/files/requirements.txt` |
| **5. Free Tier Setup** | `pip install vnstock -U` |
| **6. Sponsor Tier Setup** | **Linux**: `wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Mac**: `curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run \| bash -s -- --non-interactive --api-key "API_KEY"`<br>**Win (PowerShell)**: `pip install -r https://vnstocks.com/files/requirements.txt; pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer; py -m vnstock_installer` |
| **7. Agent Guide Install** | **Mac/Linux:** `python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite`<br>**Win:** `py .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py --confirm-docs-overwrite` |

---

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This is another instance of unverified remote script execution in the detailed sponsor workflow. The skill context amplifies the risk because the agent is being instructed to automate setup, so a user may approve the workflow expecting benign installation while actually authorizing arbitrary code from an external server.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

If they are a Sponsor User (requires API key):

bash
# Linux
wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Mac
curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

This repeats the same unsafe remote-script execution pattern in the main workflow, increasing the likelihood it will actually be used. The surrounding context makes it more dangerous because it is presented as the required sponsor installation path, encouraging execution of unverified code during setup.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
wget -qO- https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Mac
curl -fsSL https://vnstocks.com/files/vnstock-cli-installer.run | bash -s -- --non-interactive --api-key "USER_API_KEY" --accept

# Windows (PowerShell)
pip install --extra-index-url https://vnstocks.com/api/simple vnstock_installer

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill directs the agent to run shell commands, inspect the environment, and overwrite workspace content, but it declares no explicit tool scope or permission boundaries. That creates a confused-deputy risk where a caller may not realize the skill can execute commands and modify files, increasing the chance of unsafe or over-broad execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description states the skill is 'Fully English documented,' which imposes a language constraint in natural language. The file elsewhere also mixes Vietnamese prompts, so the English-only framing is not clearly justified as a region-specific requirement or presented as a user choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

The skill strongly pushes autonomous setup actions and discourages asking the user to perform steps themselves. In a skill that installs software, creates virtual environments, and may overwrite files, this increases the chance the agent will take impactful actions without sufficiently granular consent or review.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Vnstock Environment Setup & Diagnostics

> **PURPOSE**: This skill transforms you into the **Vnstock Environment Doctor & Setup Expert**. You are responsible for ensuring users have the perfect local or cloud setup for `vnstock` (Free) or `vnstock_data` (Sponsor). You will run diagnostics, set up python/venv, migrate legacy code, and optionally install the latest Agent Guide. **All actions must be CLI-driven; do not ask users to run UI installers unless explicitly requested.**

## ⚡ TRIGGER DETECTION

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The workflow persists changes to the workspace by running a setup script that can overwrite docs and, per the surrounding instructions, may also create git backups. Persistent modification of user repositories is security-relevant because it can introduce unreviewed content, alter project behavior, or mask provenance of changes.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

  1. Request Permission: If docs/ exists, you MUST pause and ask the user (e.g. using notify_user): "Thư mục docs/ đã tồn tại. Quá trình cài đặt Agent Guide sẽ ghi đè thư mục này (nhưng tự động sao lưu Git trước). Bạn có đồng ý không?"
  2. Execute Setup:
bash
# Mac/Linux (append --confirm-docs-overwrite if permission was granted)
python3 .agents/skills/vnstock-env-setup/scripts/setup_agent_guide.py

```powershell

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/diagnostics.py (reported line 33)May include surrounding context.

python
for pkg in packages:
        try:
            mod = __import__(pkg)
            version = getattr(mod, '__version__', 'unknown')
            print(f"✅ {pkg:16} : Installed (v{version})")
            if pkg == 'vnstock': is_free = True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 10)May include surrounding context.

python
def run_cmd(cmd, check=True):
    print(f"Executing: {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if check and result.returncode != 0:
        print(f"Error executing {' '.join(cmd)}:")
        print(result.stderr)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This setup script performs powerful side effects beyond simple guide installation: it installs system software, initializes repositories, stages all files, changes Git config, and creates commits. That expanded capability is risky because a user invoking a documentation/setup tool would not reasonably expect OS-level changes and durable version-control mutation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script can perform automatic OS-level package installation using brew, apt-get with sudo, and PowerShell-downloaded installers. For an agent guide setup script, this is unusually privileged behavior that expands the attack surface to system-wide changes and remote binary installation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

The script silently changes Git configuration in the current repository by setting user.email without explicit user consent. In a setup script, modifying repository metadata can tamper with audit trails and cause future commits to be attributed to an unexpected identity.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 44)May include surrounding context.

python
run_cmd(["git", "init"])
        run_cmd(["git", "add", "."])
        # Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Silently configuring Git identity inside the user's repository is a hidden state change with provenance implications. In the context of an environment/setup helper, this is more dangerous because users may trust it as non-invasive while it modifies audit-relevant configuration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This line silently sets user.name in the user's repository, altering commit attribution. Even though it is not code execution, it changes version-control state in a way that is unnecessary for a guide installer and can mislead later provenance or compliance reviews.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 45)May include surrounding context.

python
run_cmd(["git", "add", "."])
        # Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Initial commit created.")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The script automatically creates a Git commit over the entire working tree, potentially capturing unrelated files, secrets, or in-progress work. Because this occurs as part of a setup flow, users may not expect broad repository mutation or the creation of durable history entries.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 46)May include surrounding context.

python
# Need to handle edge case where identity is not configured
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Initial commit before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Initial commit created.")
    else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This repeats the same silent repository identity modification in an existing Git repository. In context, that is more dangerous because it affects an already-established project and can unexpectedly alter future commit attribution.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 52)May include surrounding context.

python
else:
        print("📦 Git repository detected. Creating backup commit...")
        run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This line sets the repository's user.name without notice during a backup operation. That is an unnecessary side effect for installing documentation/skills and can interfere with repository ownership and audit expectations.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 53)May include surrounding context.

python
print("📦 Git repository detected. Creating backup commit...")
        run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Workspace backed up in a commit.")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The script creates a backup commit in the user's existing repository after running git add ., which can capture all current changes rather than only installer-related files. This can expose sensitive or unfinished work to repository history and makes the setup script unexpectedly state-changing.

Content

Scanner excerpt · scripts/setup_agent_guide.py (reported line 54)May include surrounding context.

python
run_cmd(["git", "add", "."])
        subprocess.run(["git", "config", "user.email", "agent@vnstocks.com"], capture_output=True)
        subprocess.run(["git", "config", "user.name", "AI Agent"], capture_output=True)
        res = subprocess.run(["git", "commit", "-m", "Backup workspace before Agent Guide installation"], capture_output=True)
        if res.returncode == 0:
            print("✅ Workspace backed up in a commit.")
        else:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script deletes and replaces local skill directories and fully overwrites the docs directory with content from a remote repository. This is dangerous because it can destroy local customizations and trust remote content without pinning, review, or granular confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

These lines delete existing local skill directories and replace them without an explicit user-facing warning or per-item confirmation. In an agent skill ecosystem, that can remove user-authored logic and substitute remotely sourced behavior, increasing both data-loss and supply-chain risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill says 'All actions must be CLI-driven; do not ask users to run UI installers unless explicitly requested.' This is a natural-language constraint on interaction mode that may override user preference without offering a choice or documenting a policy reason.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

The agent-guide installation flow implies broad write and repository-modification capability, including backup/commit behavior and overwriting docs, without clearly constraining what may be changed. Even with a docs overwrite prompt, the effective permission scope is wider than necessary for a diagnostic/setup skill.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Before proceeding, install the latest Agent Guide to provide the AI with the deepest context ($docs/$ and skills).

  1. Check for existing docs: ls -d docs/ 2>/dev/null
  2. Request Permission: If docs/ exists, you MUST pause and ask the user (e.g. using notify_user): "Thư mục docs/ đã tồn tại. Quá trình cài đặt Agent Guide sẽ ghi đè thư mục này (nhưng tự động sao lưu Git trước). Bạn có đồng ý không?"
  3. Execute Setup:
bash
# Mac/Linux (append --confirm-docs-overwrite if permission was granted)