Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious with medium confidence, mainly because filing text is passed to an agent-capable CLI without explicit tool restrictions, creating a prompt-injection risk.
Consider the suspicious verdict before installing. In particular, review whether the Claude CLI fallback is necessary and what tools and local resources it can access; retrieved filings are untrusted input. Also consider that custom questions may be sent to a model provider, and dependency versions are not pinned. The scan was partial: it reports all 10 listed components scanned, but several referenced local paths were missing, so the evidence is incomplete.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if pause:
time.sleep(pause)
try:
r = requests.get(url, headers=HEADERS, timeout=timeout)
if r.status_code in (429, 500, 502, 503, 504):
last = f"HTTP {r.status_code}"
continue
Downloaded filing passages are incorporated into the prompt supplied to an agent-capable CLI without an explicit tool restriction. This is not direct shell execution of network text, but malicious instructions in a filing or poisoned cache could redirect the agent and potentially access local resources under its existing permissions; SEC hosting does not make issuer-authored text trusted instructions.
"""Provider-dispatch for one system+user call, returns raw reply text."""
if provider == "claude-cli":
import subprocess
res = subprocess.run(
["claude", "-p", "--model", model, "--system-prompt", system],
input=user, capture_output=True, text=True, timeout=180)
if res.returncode != 0:
Without declared permissions the skill's intent is opaque and cannot be validated.
Custom questions are transmitted to the selected model provider, but the custom-query documentation does not explicitly disclose that data flow. Although SEC passages are public and cloud providers are mentioned elsewhere, questions can contain confidential research or investment strategy; the local CLI fallback also does not imply local-only inference.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if pause:
time.sleep(pause)
try:
r = requests.get(url, headers=HEADERS, timeout=timeout)
if r.status_code in (429, 500, 502, 503, 504):
last = f"HTTP {r.status_code}"
continue
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def _recent_filings(cik: str) -> dict:
"""Fetch the submissions index once per run (recent filings block)."""
r = _get(f"https://data.sec.gov/submissions/CIK{cik}.json")
return r.json().get("filings", {}).get("recent", {})
The subprocess call uses an argument list and does not introduce shell injection, but it invokes an agent-capable Claude CLI without explicitly disabling tools or isolating its working environment. Untrusted filing text is sent to that agent, creating a prompt-injection path whose filesystem or command impact depends on the CLI's effective permissions and configuration.
"""Provider-dispatch for one system+user call, returns raw reply text."""
if provider == "claude-cli":
import subprocess
res = subprocess.run(
["claude", "-p", "--model", model, "--system-prompt", system],
input=user, capture_output=True, text=True, timeout=180)
if res.returncode != 0:
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
"""Provider-dispatch for one system+user call, returns raw reply text."""
if provider == "claude-cli":
import subprocess
res = subprocess.run(
["claude", "-p", "--model", model, "--system-prompt", system],
input=user, capture_output=True, text=True, timeout=180)
if res.returncode != 0:
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
are forward-looking statements . Forward-looking statements can also be identified by words such as “future,” “anticipates,” “believes,” “estimates,” “expects,” “intends,” “plans,” “predicts,” “will,” “would,” “could,” “can,” “may,” and similar terms. Forward-looking statements are not guarantees of future performance and the Company’s actual results may differ significantly from the results discussed in the forward-looking statements. Factors that might cause such differences include, but are not limited to, those discussed in Part I, Item 1A of the 2025 Form 10-K and Part II, Item 1A of this Form 10-Q, in each case under the heading “Risk Factors.” The Company assumes no obligation to revise or update any forward-looking statements for any reason, except as required by law.
Unless otherwise stated, all information presented herein is based on the Company’s fiscal calendar, and references to particular years, quarters, months or periods refer to the Company’s fiscal years ended in
The open-ended requests requirement allows installations to resolve to different, unreviewed releases and provides no artifact integrity verification. This is a supply-chain hardening weakness, not evidence that the installed package is compromised or vulnerable.
requests>=2.28
beautifulsoup4>=4.11
anthropic>=0.34
# openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
The beautifulsoup4 lower bound permits unreviewed future releases and does not identify the exact artifacts used to parse external filings. This reduces reproducibility and supply-chain assurance without establishing a specific exploitable parser defect.
requests>=2.28
beautifulsoup4>=4.11
anthropic>=0.34
# openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
# BM25 is now pure-Python (no rank_bm25). `--demo` needs none of the above.
The anthropic requirement permits changing SDK versions without a reviewed lockfile or hash verification. Because this SDK runs in a process with API credentials, dependency integrity matters, although no malicious release is demonstrated here.
requests>=2.28
beautifulsoup4>=4.11
anthropic>=0.34
# openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
# BM25 is now pure-Python (no rank_bm25). `--demo` needs none of the above.
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.