ClawHub
Back to skill

Security audit

Harena

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a trading-intelligence MCP service, but it under-discloses financial-profile data sent to Harena and recommends an unpinned executable installer.

Review Harena's privacy terms before submitting registration answers or profile preferences, since those can reveal investment interests and risk tolerance. Prefer direct MCP configuration over the `npx ... @latest` installer unless you are comfortable executing the current package from the registry, and do not run the installer with elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:66
Finding

Mutable Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:66
Vulnerability Type: Supply-chain risk caused by execution of an unpinned package version
Risk Level: High

Vulnerable Code

bash
npx clawhub@latest install harena

Technical Analysis

The installation instructions invoke npx with the mutable latest tag. If the package is not already cached locally, npx can download it from the configured package registry and execute it immediately.

The effective code executed by this command can therefore change after the Skill has been reviewed. The package version and integrity digest are not pinned, and the documentation does not require users to inspect or verify the downloaded package before execution. This introduces a supply-chain trust boundary that is broader than necessary because the MCP server can also be configured directly without executing a package fetched at installation time.

This is an insecure dependency practice rather than evidence that the currently published package is malicious.

Attack Path

  1. An attacker compromises the clawhub package, its publishing credentials, the associated registry account, or another component of the package distribution chain.
  2. The attacker publishes a malicious release and causes it to resolve through the latest tag.
  3. A user follows the documented installation command.
  4. npx downloads and executes the attacker-controlled package.
  5. The malicious package executes with the operating-system privileges of the user running the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on those privileges and the local environment, the executed package could access user-readable files, environment variables, API credentials, agent configuration, and network resources or modify user-owned files.

The Skill does not itself request elevated privileges, a ...[truncated 208 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mutable latest tag with an explicitly audited package version.
  2. Pin and verify an integrity digest where the installation mechanism supports it.
  3. Document the expected package registry and package publisher identity.
  4. Prefer manual MCP configuration because it avoids executing an installer package.
  5. If an installer remains necessary, document how users can download and inspect it before execution.
  6. Add an update process that requires security review before changing the pinned package version.
  7. Warn users not to run the installation command with administrative or root privileges.

other

Warning
Location
SKILL.md:26
Finding

Privacy Statement Understates the Scope of Profile Data Transmitted to the Remote Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26-33, SKILL.md:89-101, and SKILL.md:199-203
Vulnerability Type: Incomplete privacy disclosure for remotely transmitted user-profile data
Risk Level: Medium

Relevant Documentation

text
call get_questionnaire
collect answers
call submit_questionnaire with answers
get_profile: View trading style, risk preference, and markets of interest
set_profile: Update personal preferences
Only collects watchlists for personalization

Technical Analysis

The documented registration workflow instructs the agent to obtain questionnaire answers from the user and submit those answers to the remote Harena MCP service. The available profile and personalization operations cover trading style, risk preference, markets of interest, topic subscriptions, and watchlist information.

These remote data transfers are relevant to the declared personalization functionality and do not, by themselves, demonstrate malicious exfiltration. However, the security statement says that only watchlists are collected for personalization. That statement does not accurately describe the broader profile data handled by the documented registration and profile-management workflows.

Because the endpoint is a third-party remote service, submitted information leaves the user's local environment. The project does not include corresponding disclosures about retention periods, deletion procedures, secondary processing, or the handling of questionnaire and profile information.

Attack Path

  1. A user follows the documented registration process.
  2. The agent obtains the registration questionnaire from the remote MCP service.
  3. The agent asks the user for information such as trading style, risk preference, and markets of interest.
  4. The agent submits the answers to submit_questionnaire at the Harena service.
  5. The service processes or stores profile data whose scope is broader than t ...[truncated 830 chars]
Remediation
View remediation

Remediation Suggestions

  1. Update the security and privacy sections to enumerate all categories of collected data, including questionnaire answers, trading style, risk preference, market interests, topic subscriptions, and watchlists.
  2. Explain the purpose for which each category is processed.
  3. Provide a direct privacy-policy link before users submit questionnaire answers.
  4. Document retention periods, deletion procedures, account-deactivation handling, and whether data is shared with subprocessors.
  5. Require explicit user confirmation immediately before transmitting questionnaire or profile information.
  6. Minimize submitted fields to those necessary for the requested personalization feature.
  7. Clearly distinguish locally stored information from information transmitted to and retained by the remote MCP provider.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The registration flow explicitly asks the assistant to collect questionnaire answers and submit them to Harena, and the profile tools further process trading style, risk preference, and market interests, but the skill does not clearly warn users that this personal preference data is sent to an external service. This creates a consent and privacy transparency issue, especially in a finance-related context where inferred investment preferences may be sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx clawhub@latest install harena, which fetches and executes the latest package version without pinning. If the upstream package is compromised, typosquatted, or publishes a malicious update, users could execute attacker-controlled code during installation. In this skill context, the risk is elevated because the tool also handles API keys and connects to an external MCP server.

Content

No source excerpt is available for this finding.