Fin Intel Hub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:49 AM UTC
• Version: 1.0.2

Overview

This finance data skill is mostly purpose-aligned, but it needs review because optional API keys can be exposed through raw error output despite documentation claiming sensitive data is safely redacted.

Review before installing if you plan to configure paid or quota-limited API keys. Prefer a pinned or verified installer, avoid running install commands with elevated privileges, and treat any API key that appears in logs or transcripts as exposed. The skill does not appear to trade, access financial accounts, persist background code, or perform unrelated local data collection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/macro_data.py:51

Finding

API Keys May Be Disclosed Through Raw Exception Output

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:25

Finding

Recommended Unpinned npx Installation Executes Mutable Third-Party Code

Content

View full analysis

Remediation

View remediation

install fin-intel-hub ``` 2. Publish and document the expected package provenance, registry, version, and integrity digest. 3. Use npm lockfiles and integrity metadata where installation is performed through a managed project. 4. Prefer downloading a signed or checksummed release archive when executable installer behavior is unnecessary. 5. Document how users can verify release signatures or SHA-256 hashes before installation. 6. Advise users not to run the installer with administrative privileges. 7. Periodically re-audit the pinned installer before updating the recommended version. ]]>

T08 · Insecure Dependencies

Note

• Location: scripts/yahoo_finance.py:1

Finding

Yahoo Finance Module Imports an Undeclared and Unused Third-Party Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The README instructs users to run npx clawhub install fin-intel-hub without pinning a specific clawhub version. This creates a supply-chain risk because npx will fetch the latest package at execution time, so a compromised, typosquatted, or malicious future release could execute arbitrary code on the user's system during installation. In a skill-installation context, this is more dangerous because users are explicitly encouraged to run the command locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is entirely presented in Simplified and Traditional Chinese, with no English or explicit user-selectable language option in the document itself. The policy for natural-language violations applies to all file types and flags cases where a skill enforces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub install fin-intel-hub without pinning a specific clawhub version. Because npx resolves and executes the latest published package by default, a compromised upstream package, typo-squatted replacement, or breaking update could cause users to run unintended code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This is a second unpinned npx clawhub execution path in the Traditional Chinese installation section. It carries the same supply-chain risk: users may execute whatever version is currently served, including a malicious or compromised release, directly on their system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description explicitly includes a catch-all trigger for 'any financial data research and analysis tasks,' which is broader than the concrete capabilities listed elsewhere. Overly broad routing language can cause the agent to invoke this skill for loosely related requests, increasing the chance of unnecessary external data access, unexpected behavior, or the skill being selected in contexts it was not designed to handle safely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 54)May include surrounding context.

python

end_date = datetime.now()
        start_date = end_date - timedelta(days=days)
        
        url = "https://api.glassnode.com/v1/metrics/flows/exchange_inflow"
        params = {
            "a": "BTC",
            "s": int(start_date.timestamp()),

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 100)May include surrounding context.

python

"""Fallback: Get exchange data from CoinGecko (limited but free)."""
        try:
            # CoinGecko exchange volume data as proxy
            url = "https://api.coingecko.com/api/v3/exchanges"
            response = self.session.get(url, timeout=10)
            
            if response.status_code != 200:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 200)May include surrounding context.

python

"""Fallback: Get exchange data from CoinGecko (limited but free)."""
        try:
            # CoinGecko exchange volume data as proxy
            url = "https://api.coingecko.com/api/v3/exchanges"
            response = self.session.get(url, timeout=10)
            
            if response.status_code != 200:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 133)May include surrounding context.

python

"""
        try:
            if protocol:
                url = f"https://api.llama.fi/protocol/{protocol.lower()}"
            else:
                url = "https://api.llama.fi/charts"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 135)May include surrounding context.

python

"""
        try:
            if protocol:
                url = f"https://api.llama.fi/protocol/{protocol.lower()}"
            else:
                url = "https://api.llama.fi/charts"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 173)May include surrounding context.

python

if not etherscan_key:
            # Fallback to public gas tracker
            try:
                url = "https://api.etherscan.io/api"
                params = {
                    "module": "gastracker",
                    "action": "gasoracle",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_onchain.py (reported line 243)May include surrounding context.

python

try:
            # Whale Alert API integration would go here
            # https://api.whale-alert.io/v1/transactions
            pass
        except Exception as e:
            print(f"Whale alert error: {e}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/macro_data.py (reported line 19)May include surrounding context.

python

class FREDClient:
    """Client for fetching macroeconomic data from FRED (Federal Reserve Economic Data)."""
    
    BASE_URL = "https://api.stlouisfed.org/fred"
    
    def __init__(self, api_key: Optional[str] = None):
        """

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sec_filings.py (reported line 64)May include surrounding context.

python

if not cik:
            return []
        
        url = f"https://data.sec.gov/api/xbrl/companyfacts/CIK{cik}.json"
        
        try:
            response = self.session.get(url, timeout=15)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sec_filings.py (reported line 72)May include surrounding context.

python

if not cik:
            return []
        
        url = f"https://data.sec.gov/api/xbrl/companyfacts/CIK{cik}.json"
        
        try:
            response = self.session.get(url, timeout=15)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This is a real information disclosure weakness. Although the logger sanitizes only the explicit message string, the code returns raw exception text to callers for RateLimitExceeded and ValidationError via {"error": str(e) ...}, and those exceptions may contain user input, URLs, tokens, or upstream error details. In a finance-data skill that handles API calls and external inputs, this can leak sensitive operational details or attacker-supplied content into user-visible responses and logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The request parameters hard-code "language": "en", which constrains the skill to English content regardless of user preference. This is a natural-language/locale policy concern because the file provides no user choice, opt-in, or documented region-specific justification for the restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code reads sensitive API keys from environment variables and sends them in outbound HTTP requests, but provides no confirmation prompt or user-facing disclosure before transmitting them. Although the docstrings mention API usage, they do not clearly warn that locally configured credentials will be attached to requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.