ClawHub
Back to skill

Security audit

SEC Finance

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it automatically weakens HTTPS certificate checks when fetching SEC financial data, which can let tampered data be accepted without clear user control.

Review before installing. The skill is narrowly aimed at SEC financial lookups and does not appear to persist, steal credentials, or run unrelated code, but its automatic relaxed SSL fallback can make official-looking SEC data untrustworthy on a hostile or misconfigured network. Use only where financial output will be independently checked, or require the TLS fallback to be removed before relying on it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sec_finance.py:67
Finding

Automatic TLS Certificate Validation Bypass for SEC Requests

Content
View full analysis

Vulnerability Details

File Location: scripts/sec_finance.py:67-71, 85-89, 110-116
Vulnerability Type: Automatic fallback to an SSL context that disables certificate and hostname validation
Risk Level: High

Vulnerable Code

python
def _fallback_insecure_ctx() -> ssl.SSLContext:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    return ctx

The insecure context is automatically attempted by the JSON request helper:

python
for ctx_factory in (_secure_ctx, _fallback_insecure_ctx):
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=ctx_factory()) as resp:
            return json.loads(resp.read())
    except ssl.SSLError as e:
        last_error = e
        continue
    except urllib.error.HTTPError as e:
        if e.code == 429 and attempt < retries:
            time.sleep(3 * (attempt + 1))
            last_error = e
            break
        if e.code == 404:
            raise ValueError(f"CIK or resource not found: {url}") from e
        raise ValueError(f"HTTP {e.code} fetching {url}: {e.reason}") from e
    except urllib.error.URLError as e:
        last_error = e
        continue

It is also automatically attempted by the text request helper:

python
last_error = None
for ctx_factory in (_secure_ctx, _fallback_insecure_ctx):
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=ctx_factory()) as resp:
            return resp.read().decode("utf-8", errors="replace")
    except Exception as e:
        last_error = e
raise ConnectionError(f"Failed to fetch {url}: {last_error}")

Technical Analysis

_fallback_insecure_ctx() disables both certificate-chain validation and hostname verification. Consequently, HTTPS no longer authenticates the remote SEC server when this context is used.

Both network helpers automatically ...[truncated 1839 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove _fallback_insecure_ctx() and never set verify_mode to ssl.CERT_NONE or check_hostname to False.
  2. Use only ssl.create_default_context() for SEC requests and fail closed when certificate validation fails.
  3. If a deployment requires a private or additional certificate authority, configure an explicit trusted CA bundle through cafile or the system trust store rather than disabling verification.
  4. Narrow exception handling in _get_text; do not use except Exception to trigger changes in transport security.
  5. Retry only errors that are demonstrably transient, while preserving the same validated SSL context for every retry.
  6. Log or return a clear certificate-validation error so operators can repair the host trust store instead of silently weakening security.
  7. Add tests asserting that invalid, expired, self-signed, and hostname-mismatched certificates are rejected without an insecure retry.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The HTTPS client silently retries with an insecure SSL context, so users receive no indication that transport authenticity has been disabled. This creates covert downgrade behavior where network attackers can inject false SEC/EDGAR responses without triggering obvious warnings or failures.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes local Python scripts and accesses external SEC endpoints, implying file-read and network capabilities, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization gap: an agent or reviewer cannot easily determine the intended capability boundary, increasing the risk of overbroad execution or misuse if the skill is repurposed or modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The alias "li" is highly ambiguous because it is a common surname, token, and substring in unrelated text. In a finance lookup skill, this can cause issuer mis-resolution, leading the agent to fetch or analyze the wrong company's SEC data and produce materially incorrect financial conclusions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The alias "ke" is overly short and ambiguous, making accidental matches against unrelated text likely. In this skill's context, that can route requests to KE Holdings incorrectly, causing retrieval of the wrong SEC filings or financial metrics and contaminating downstream analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sec_finance.py (reported line 29)May include surrounding context.

python
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 "
    "(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
)
XBRL_BASE = "https://data.sec.gov/api/xbrl"
EDGAR_BASE = "https://www.sec.gov/cgi-bin/browse-edgar"
ISSUERS_FILE = Path(__file__).resolve().parent.parent / "references" / "issuers.json"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code explicitly falls back to an SSL context with certificate verification and hostname checks disabled. That allows a man-in-the-middle attacker or hostile network device to spoof SEC endpoints and return tampered financial data, defeating the trust model of a read-only data retrieval tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The currency preference order prioritizes CNY over USD, and later formatting also defaults to the yuan symbol and CNY when no currency is available. This imposes a specific locale/currency presentation choice in natural-language/user-visible output without offering a user choice or documenting a region-specific reason.

Content

No source excerpt is available for this finding.