ClawHub
Back to skill

Security audit

投资组合分析技能

Security checks for vulnerabilities and agentic risk

Overview

This is a local financial backtesting skill with some documentation and dependency hygiene issues, but no evidence of hidden network access, persistence, or malicious behavior.

Install in a dedicated virtual environment, use the minimal manifest/README dependency set instead of the broader SKILL.md yfinance/plotly command, run it on non-sensitive CSVs first, and write outputs to a dedicated folder to avoid overwriting prior reports. Do not provide API keys; the inspected code does not use them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned and Unnecessary Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:23-25
  • README.md:24-27
  • INSTALLATION.md:5-8
  • 优化使用指南.md:29-32

Vulnerability Type: Uncontrolled third-party dependency resolution and excessive dependency scope
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:23-25:

bash
pip install yfinance pandas numpy matplotlib seaborn plotly

README.md:24-27:

bash
pip install pandas numpy matplotlib seaborn

INSTALLATION.md:5-8:

bash
pip install pandas numpy matplotlib seaborn

优化使用指南.md:29-32:

bash
pip install pandas numpy matplotlib seaborn

Technical Analysis

The installation instructions invoke pip without exact version constraints, integrity hashes, or a reviewed lock file. Consequently, package selection depends on the currently configured package index and the package versions available at installation time. The installed code may therefore differ from the code reviewed or tested by the publisher.

In addition, SKILL.md directs users to install yfinance and plotly, although neither package is imported by the supplied Python source or declared in manifest.json. These unnecessary packages and their transitive dependencies expand the supply-chain attack surface. Installing yfinance is also inconsistent with the project's declared local-only dependency set and offline runtime design.

The audit found no evidence that the named packages are currently malicious. Exploitation requires compromise of a package, one of its transitive dependencies, the configured package index, or the dependency-resolution environment.

Attack Path

  1. A user follows the documented installation command.
  2. pip contacts the configured package index and resolves the latest compatible versions of the named packages and their transitive dependencies.
  3. An attacker compromises a resolved package release, dependency, package-index account, mir ...[truncated 1258 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove unused dependencies from SKILL.md. The documented runtime set should match the imports and manifest.json; specifically, remove yfinance and plotly unless corresponding functionality is deliberately added and reviewed.
  2. Define exact, reviewed dependency versions in a requirements or lock file, for example:
    text
    pandas==REVIEWED_VERSION
numpy==REVIEWED_VERSION
matplotlib==REVIEWED_VERSION
seaborn==REVIEWED_VERSION
  3. Generate and verify cryptographic hashes for all direct and transitive dependencies. Install with hash enforcement, such as:
    bash
    python -m pip install --require-hashes -r requirements.txt
  4. Use a reproducible lock-generation process and review dependency changes before updating the lock file.
  5. Install dependencies inside a dedicated virtual environment under a non-privileged account. Do not run pip as an administrator or root user.
  6. Use a trusted, explicitly configured package index or an internally controlled package mirror.
  7. Apply automated dependency vulnerability and provenance scanning in CI.
  8. Make all installation documents and manifest.json reference the same minimal dependency set and installation procedure.
  9. If fully offline operation is required, distribute a reviewed wheel bundle with recorded hashes and install only from that local bundle using --no-index.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file uses a single forced language for installation and usage instructions, which can violate language/locale policy when no user opt-in or alternative is provided. The document does not indicate that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file presents all operational and safety information exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a clearly justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file title and all substantive content are written entirely in Chinese, which imposes a specific language on users without any stated opt-in, alternative language option, or region-specific justification. The policy for this audit flags language or locale constraints when they are enforced implicitly through the skill's natural-language materials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill is presented primarily in Chinese and labels the generated report as Chinese-market analysis, with no indication that users can select another language or locale. This can violate language/locale policy when a skill implicitly requires a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly claims the skill only uses local CSV files and makes no network requests, yet the dependency on yfinance and the documented single-symbol workflow strongly imply external market-data retrieval. This mismatch can mislead users and reviewers about the skill's real data-access behavior, causing it to be run in environments where outbound access is prohibited or sensitive.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Saying no API keys are needed because the skill only uses local CSV data is contradicted by the documented --symbol analysis path, which suggests data can be obtained externally rather than solely from local files. Even if no key is required, undisclosed network access is a security-relevant behavior because it affects privacy, policy compliance, and trust boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description, feature list, and network description are entirely in Chinese, which indicates the skill is presented in a single language with no stated option for users to choose another language or locale. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The backtest routine writes multiple files (text report, JSON data, and several PNG charts) to a user-controlled output path without any confirmation, dry-run mode, or safeguards that the destination exists and is intended. In an agent or automated skill context, implicit filesystem side effects can overwrite existing artifacts or create unexpected persistent data, which is a real security/safety issue even though there is no sign of malicious intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The example report title is explicitly presented in Chinese ("中国市场滚动风险平价组合分析报告"), and the README overall documents the skill entirely in Chinese without indicating that users may select another language. This suggests a fixed locale/language behavior rather than an opt-in choice, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language strings throughout the file, including the module description, CLI description, status messages, and generated report content, are all hard-coded in Chinese. There is no indication that the user can opt into another language or that the Chinese-only constraint is justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents that rows with NaN values are deleted, which is a data-affecting operation. Although the guide explains that missing values are handled, it does not warn users that records will be removed and may materially change results or discard input data during preprocessing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This is a markdown file, so SQP-2 applies to omitted warnings about behaviors that can affect user data or system state. The document lists multiple generated output files and later provides execution commands, but it does not include any explicit warning or disclosure that the skill creates files in the output directory and may overwrite existing analysis artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.