ClawHub
Back to skill

Security audit

Libu Premarket

Security checks across malware telemetry and agentic risk

Overview

This paid stock-report skill mostly matches its advertised purpose, but it under-discloses a cross-skill code import path that can run code from another local skill directory.

Review before installing if you have other local OpenClaw skills installed, especially tushare-finance, because this skill may import and execute code from that separate local skill path. Expect it to use network market-data services, read TUSHARE_TOKEN and CLAWTIP_SM4_KEY if configured, and write cache, report, and payment-order files under ~/.openclaw.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes capabilities that access environment variables, read and write local files, and contact external services, yet no permissions are declared. This creates a transparency and consent problem: users and hosting agents cannot accurately assess or sandbox the skill before execution, increasing the chance of over-privileged operation or unexpected data exposure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is stock selection/report generation, but the documented behavior also includes payment-order creation, cryptographic voucher handling, subscription enforcement, reading and migrating order data under ~/.openclaw/skills/orders, network retrieval from multiple third-party services, and local archive extraction and caching. This behavioral expansion materially changes the trust model: a user expecting a market-analysis tool may unknowingly run software that handles payment state, local order artifacts, and broader filesystem/network activity.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The skill contains payment enforcement logic unrelated to its core stock-selection function and delegates trust to an external payment_utils module. In an agent-skill setting, this expands the trusted computing base and creates an extra execution dependency that could be replaced, tampered with, or used to block or influence execution in ways users do not expect.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The script prepends a user-home skills directory to sys.path and imports api_client from there, which allows code from a mutable local path to run inside this skill. Combined with reading an environment token, this creates a realistic path-hijack/supply-chain risk where a malicious local module can execute arbitrary code and access credentials.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill makes multiple outbound requests to third-party financial data providers without an upfront consent or privacy notice. Even if the transmitted data is limited, requests expose user IP, timing, market interests, and possibly queried symbols to external services, which is a privacy and operational transparency issue.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
Confidence
93% confidence
Finding
pandas>=1.5.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0
Confidence
98% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0
Confidence
92% confidence
Finding
numpy>=1.23.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=1.5.0
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0
Confidence
91% confidence
Finding
tushare>=1.2.89

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
numpy>=1.23.0
tushare>=1.2.89
gmssl>=3.2.0
Confidence
90% confidence
Finding
gmssl>=3.2.0

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
requests==2.28.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.