ClawHub
Back to skill

Security audit

agentic-trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is for disclosed real-money autonomous trading, but its install path immediately runs mutable remote shell code before the trading consent gate can protect the user.

Review before installing. Do not run the one-line curl-to-bash installer as written unless you trust the publisher and current repository contents; prefer a pinned release or commit, inspect the installer first, and keep the agent in dry-run until you personally verify broker permissions, caps, notifications, and stop procedures. Treat this as real-money trading software, not a generic helper.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:36
Finding

Unverified Remote Installer Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable code:

bash
curl -fsSL https://raw.githubusercontent.com/traderhc123/agentic-trader/main/install.sh | bash

Technical Analysis

The installation command retrieves install.sh from the mutable main branch of a personal GitHub repository and pipes the response directly into Bash. This gives the downloaded content arbitrary command-execution capability under the invoking user's account.

The command does not pin the payload to an immutable commit or version, verify a cryptographic checksum or signature, or allow inspection before execution. Consequently, the effective payload can change after this Skill has been reviewed. The audited project contains only SKILL.md; the installer and application implementation are not included locally, so their behavior cannot be statically verified.

Direct arbitrary shell execution exceeds the minimum privileges necessary to distribute a Python application. Although the command does not explicitly invoke elevated privileges, it grants the remote payload all permissions available to the current user. The payload also runs before the documented application-level consent gate, so that gate cannot constrain the installer.

Attack Path

  1. An attacker compromises the referenced GitHub account, repository, publishing credentials, or another mechanism capable of changing the main branch.
  2. The attacker modifies install.sh to include arbitrary malicious shell commands.
  3. A user follows the setup instructions in SKILL.md.
  4. curl downloads the attacker-controlled response without preserving it for review.
  5. Bash immediately executes the response with the user's privileges.
  6. The payload can access or alter resources available to that user before the trading application's consent checks are reached.

Imp

...[truncated 829 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation pattern.
  2. Include the installer and relevant application code in the reviewed package, or distribute a signed, versioned release artifact from an immutable location.
  3. Pin downloads to a specific release or commit rather than the mutable main branch.
  4. Publish and verify a cryptographic checksum or trusted digital signature before execution.
  5. Download the installer to a local file first and instruct the user to inspect it before running it.
  6. Ensure installation runs as an ordinary user without sudo or other privilege escalation.
  7. Install Python dependencies inside an isolated virtual environment and pin their versions and hashes.
  8. Include referenced operational instructions such as BOOT.md locally so setup behavior, credential handling, network access, and trading controls can be audited together.
  9. Keep the human consent gate, but do not treat it as protection against installer compromise because remote code executes before that control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | bash pattern is a classic dangerous command-chaining construct because it executes untrusted remote content immediately with the user's shell. In a skill for autonomous trading software, compromise of the install path is especially serious because it could steal brokerage credentials, alter trading logic, or implant persistent malware affecting financial accounts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Setup

bash
curl -fsSL https://raw.githubusercontent.com/traderhc123/agentic-trader/main/install.sh | bash
cd ~/agentic-trader
./.venv/bin/python agent.py setup    # follow BOOT.md — written for you
./.venv/bin/python agent.py run

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
Signal sources: `manual` (human's own commands), `url` (any JSON feed), or
`agenthc` — AgentHC's Agentic Day Trade Ideas journal feed (~$10/day paid in
sats via the built-in Lightning wallet; free hypothetical track record at
https://api.traderhc.com/api/v1/trading/day-trade-ideas/track-record).

Full assistant instructions: [BOOT.md](https://github.com/traderhc123/agentic-trader/blob/main/BOOT.md)

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The setup instructions tell users to fetch and immediately execute a remote shell script via curl ... | bash, which bypasses review and integrity verification. If the GitHub content, account, network path, or referenced branch is compromised, an attacker can run arbitrary code on the user's machine during installation.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Setup

bash
curl -fsSL https://raw.githubusercontent.com/traderhc123/agentic-trader/main/install.sh | bash
cd ~/agentic-trader
./.venv/bin/python agent.py setup    # follow BOOT.md — written for you
./.venv/bin/python agent.py run