ClawHub
Back to skill

Security audit

Industry Research CN

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate industry research helper that uses public web and market data, with one narrow caution about editing its own stock-mapping script.

Install only if you are comfortable with public financial-data lookups and local Python script execution. Require confirmation before any dependency installation or edits to stock_filter.py, and treat generated investment analysis as research support, not financial advice.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The workflow tells the agent to modify a local script (`stock_filter.py`) during normal report generation, which exceeds the expected read-only behavior of a research skill. Allowing runtime code changes based on external data or validation discrepancies can lead to unauthorized local file modification, persistence of bad logic, or accidental tampering with future runs.

Static analysis

No suspicious patterns detected.