Libu Premarket

• Outcome: Review
• Latest audit: Jul 18, 2026 · 2:03 AM UTC
• Version: 14.0.11

Overview

This paid stock-report skill mostly matches its advertised purpose, but it under-discloses a cross-skill code import path that can run code from another local skill directory.

Review before installing if you have other local OpenClaw skills installed, especially tushare-finance, because this skill may import and execute code from that separate local skill path. Expect it to use network market-data services, read TUSHARE_TOKEN and CLAWTIP_SM4_KEY if configured, and write cache, report, and payment-order files under ~/.openclaw.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities that access environment variables, read and write local files, and contact external services, yet no permissions are declared. This creates a transparency and consent problem: users and hosting agents cannot accurately assess or sandbox the skill before execution, increasing the chance of over-privileged operation or unexpected data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is stock selection/report generation, but the documented behavior also includes payment-order creation, cryptographic voucher handling, subscription enforcement, reading and migrating order data under ~/.openclaw/skills/orders, network retrieval from multiple third-party services, and local archive extraction and caching. This behavioral expansion materially changes the trust model: a user expecting a market-analysis tool may unknowingly run software that handles payment state, local order artifacts, and broader filesystem/network activity.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The skill contains payment enforcement logic unrelated to its core stock-selection function and delegates trust to an external payment_utils module. In an agent-skill setting, this expands the trusted computing base and creates an extra execution dependency that could be replaced, tampered with, or used to block or influence execution in ways users do not expect.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script prepends a user-home skills directory to sys.path and imports api_client from there, which allows code from a mutable local path to run inside this skill. Combined with reading an environment token, this creates a realistic path-hijack/supply-chain risk where a malicious local module can execute arbitrary code and access credentials.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill makes multiple outbound requests to third-party financial data providers without an upfront consent or privacy notice. Even if the transmitted data is limited, requests expose user IP, timing, market interests, and possibly queried symbols to external services, which is a privacy and operational transparency issue.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only, which allows future unreviewed versions to be installed and can also lead to non-reproducible environments. In a finance-oriented skill that relies on external data libraries, this increases supply-chain and stability risk because different installations may resolve to different package versions with different security properties.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0

• Confidence: 98% confidence
• Finding: The requirement uses a lower-bound specifier, which permits installation of many different versions and undermines reproducibility. This is more dangerous here because the same dependency is also flagged as having a known vulnerable version in the project context, so weak pinning can leave deployments inconsistently exposed or accidentally resolve to insecure versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0

• Confidence: 92% confidence
• Finding: An unpinned numpy dependency creates non-deterministic builds and increases supply-chain exposure if a malicious or breaking upstream release is pulled during installation. While not an immediate exploit by itself, it weakens change control and can introduce vulnerable code without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0

• Confidence: 91% confidence
• Finding: Using only a minimum version for tushare means installations may fetch varying versions over time, reducing reproducibility and increasing supply-chain risk. Because this skill is built around market data workflows, unexpected dependency changes could affect both reliability and security-sensitive network behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0

• Confidence: 90% confidence
• Finding: The gmssl dependency is unpinned, which is more sensitive than ordinary utility libraries because cryptographic packages directly affect confidentiality and integrity guarantees. Allowing arbitrary newer versions without review can introduce insecure changes, regressions, or supply-chain compromise into crypto-related functionality.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The static finding indicates requests 2.28.0 has multiple known advisories, including credential leakage and session verification issues. In a stock-analysis skill that likely performs outbound HTTP requests to market data providers, these flaws can expose credentials, weaken transport security assumptions, or enable unsafe handling of attacker-controlled responses.

Static analysis

No suspicious patterns detected.