0602-tosr2-02

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stock-analysis purpose, but its optional Twitter/X scanners handle live session cookies and pass the full environment to an external CLI, which warrants Review.

Install only after reviewing the Twitter/X feature carefully. Prefer running stock analysis, portfolio, dividend, and hot scanning without social auth; do not place unrelated secrets in this skill's .env; avoid granting Terminal Full Disk Access; and use a dedicated low-value Twitter/X account or omit the bird integration until credentials are scoped and the subprocess environment is minimized.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/hot_scanner.py:22

Finding

Full Process Environment Exposed to a Third-Party Twitter CLI

Content

View full analysis

Remediation

View remediation

dict[str, str]: credentials = {} if not path.exists(): return credentials for raw_line in path.read_text(encoding="utf-8").splitlines(): line = raw_line.strip() if not line or line.startswith("#") or "=" not in line: continue key, value = line.split("=", 1) key = key.strip() if key in ALLOWED_BIRD_KEYS: credentials[key] = value.strip().strip('"').strip("'") return credentials ``` 3. Construct a minimal subprocess environment instead of copying the complete parent environment: ```python credentials = load_bird_credentials(ENV_FILE) bird_env = { "PATH": os.environ.get("PATH", ""), "AUTH_TOKEN": credentials.get("AUTH_TOKEN", os.environ.get("AUTH_TOKEN", "")), "CT0": credentials.get("CT0", os.environ.get("CT0", "")), } result = subprocess.run( [bird_bin, "search", query, "-n", "15", "--json"], capture_output=True, text=True, timeout=30, env=bird_env, check=False, ) ``` 4. Reject or ignore unexpected `.env` keys and duplicate credential definitions. 5. Resolve `bird` to an explicitly configured, verified executable rather than relying on the ambient `PATH`. 6. Document that the Twitter integration receives account session credentials and should run in an isolated environment without unrelated secrets. 7. Prefer a scoped API credential over reusable browser session cookies where Twitter/X provides an appropriate supported mechanism. ]]>

T08 · Insecure Dependencies

Warning

• Location: docs/HOT_SCANNER.md:122

Finding

Unpinned and Globally Installed Runtime Dependencies Create a Supply-Chain Exposure

Content

View full analysis

=0.2.40", # "pandas>=2.0.0", # "fear-and-greed>=0.4", # "edgartools>=2.0.0", # "feedparser>=6.0.0", # ] ``` Representative declarations in the other executable scripts include: ```python # dependencies = ["yfinance>=0.2.40"] ``` ### Technical Analysis The Twitter/X integration instructs users to install `@steipete/bird` globally without selecting an exact reviewed version or verifying package integrity. The Python scripts similarly use minimum-version constraints rather than exact versions or a committed lockfile. A lower-bound dependency such as `yfinance>=0.2.40` allows later releases to be selected automatically when `uv run` resolves the script environment. Consequently, the code executed during package installation and import can change after this Skill has been reviewed. No evidence was found that the currently named packages are malicious. The issue is that dependency resolution is not reproducible and provides no cryptographic assurance that users execute the same dependency versions that were audited. The risk is amplified for `bird` because it is: - Installed globally. - Invoked as a subprocess by the Skill. - Given Twitter/X authentication cookies. - Given the complete ...[truncated 1490 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: docs/HOT_SCANNER.md:132

Finding

Optional Setup Recommends Excessive Full Disk Access for Social Scanning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (48)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 114)May include surrounding context.

md

GET  /portfolios
   POST /portfolios
   PUT  /portfolios/{id}
   DELETE /portfolios/{id}

   GET  /portfolios/{id}/assets
   POST /portfolios/{id}/assets

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 119)May include surrounding context.

md

GET  /portfolios/{id}/assets
   POST /portfolios/{id}/assets
   PUT  /portfolios/{id}/assets/{ticker}
   DELETE /portfolios/{id}/assets/{ticker}

   GET  /portfolios/{id}/performance?period=weekly
   GET  /portfolios/{id}/summary

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · App-Plan.md (reported line 126)May include surrounding context.

md

GET  /alerts
   POST /alerts
   DELETE /alerts/{id}

   GET  /user/subscription
   POST /user/subscription/upgrade

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is substantial overlap with the declared core purpose of stock/crypto analysis, and the code does support portfolio analysis/tracking at a basic level. However, the description materially overstates several major features that are absent from the supplied code chunk: no watchlist/alert system, no dividend analysis, no hot scanner or viral trend detection, and no real rumor/early-signal detection. The code instead performs conventional ticker analysis and some market/news risk checks. Additionally, the description emphasizes Yahoo Finance data, but the code also pulls from other external sources/resources (Google News RSS, Fear & Greed, SEC EDGAR), which are not mentioned. Because multiple prominent declared capabilities are missing and some accessed resources differ from the description, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents a comprehensive investment-analysis skill centered on Yahoo Finance data with portfolio management, alerts, dividend analysis, and stock scoring. The supplied code chunk does not implement those broader capabilities; instead it specifically performs trend and buzz scanning across multiple public sources. While the declared description does mention viral trend detection and rumor/early-signal finding, this code supports only that subset. Because the actual code accesses significant undeclared external resources (CoinGecko, Google News, Reddit, Twitter/X via subprocess) and lacks several major declared functions, the description does not accurately represent this code chunk as a whole.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is consistent with one subset of the description—portfolio management for stocks and cryptocurrencies using Yahoo Finance data. It stores portfolios locally, validates tickers with yfinance, and shows current valuation and profit/loss. However, the declared description presents a much broader analytical skill with multiple advanced capabilities (alerts, dividend analysis, scoring, trend scanning, rumor detection, etc.) that are not present in this code chunk. This is a description-behavior mismatch because the actual code’s primary behavior is much narrower than the declared purpose. There are no obvious undeclared dangerous capabilities; the mismatch is mainly overstatement of functionality.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · TODO.md (reported line 88)May include surrounding context.

md

- [ ] Add timeout per indicator (10s max)
- [ ] Test with multiple stocks in sequence
- [ ] Measure actual runtime improvement
- [ ] Update SKILL.md with new runtime (target: 3-4s)

**Expected Impact**:
- Reduce runtime from 6-10s to 3-4s per stock

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · TODO.md (reported line 193)May include surrounding context.

md

- [ ] Add timeout per indicator (10s max)
- [ ] Test with multiple stocks in sequence
- [ ] Measure actual runtime improvement
- [ ] Update SKILL.md with new runtime (target: 3-4s)

**Expected Impact**:
- Reduce runtime from 6-10s to 3-4s per stock

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to extract live auth_token and ct0 cookies from x.com and reuse them for automation. Those values are effectively session credentials; if copied into files, environment exports, logs, or shared shells, an attacker could hijack the user's Twitter/X session and act as that account.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The documentation recommends storing live Twitter/X authentication tokens in a local .env file in the skill directory. Even if .env is a common pattern, placing session tokens there increases the risk of accidental source control inclusion, local disclosure, backup leakage, or reuse by other processes, especially because these are not scoped API secrets but active session cookies.

Content

Scanner excerpt · docs/HOT_SCANNER.md (reported line 149)May include surrounding context.

Create .env file in the skill directory:

bash

# /path/to/stock-analysis/.env
AUTH_TOKEN=your_auth_token_here
CT0=your_ct0_token_here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Referencing and loading a project-local .env file gives the script access to potentially sensitive credentials unrelated to hot-stock scanning. Because the skill also makes external requests and launches a subprocess, this credential access meaningfully increases the risk of accidental disclosure or misuse.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 22)May include surrounding context.

python

from collections import defaultdict
from concurrent.futures import ThreadPoolExecutor, as_completed

# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
    with open(ENV_FILE) as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Opening the .env file directly is part of a broad credential-ingestion pattern that is unnecessary for most of the scanner’s functions. In an agent skill, unnecessary secret access is dangerous because it expands the blast radius if any later component mishandles inherited state or performs unintended transmission.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 23)May include surrounding context.

python

from concurrent.futures import ThreadPoolExecutor, as_completed

# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
    with open(ENV_FILE) as f:
        for line in f:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Invoking the external bird executable gives the skill a broader execution capability than its stated purpose requires. In an agent setting, any unnecessary local execution surface is dangerous because it can be abused through binary replacement, unexpected runtime behavior, or secret-bearing environment inheritance.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Copying the full process environment and passing it into a subprocess can expose credentials, API tokens, and unrelated configuration to that child process. In this file, that risk is amplified because the environment is pre-populated from .env, making secret propagation to bird very likely if such values exist.

Content

Scanner excerpt · scripts/hot_scanner.py (reported line 387)May include surrounding context.

python

for category, query in searches:
                try:
                    env = os.environ.copy()
                    result = subprocess.run(
                        [bird_bin, "search", query, "-n", "15", "--json"],
                        capture_output=True, text=True, timeout=30, env=env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The code is explicitly designed to read a repository-adjacent .env file for credentials used by the Bird CLI. Accessing secrets from local storage is expected functionality in some tools, but in this context it becomes security-relevant because those secrets are then propagated to an external subprocess, increasing exposure beyond the local script.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 30)May include surrounding context.

python

# Bird CLI path
BIRD_CLI = "/home/clawdbot/.nvm/versions/node/v24.12.0/bin/bird"
BIRD_ENV = Path(__file__).parent.parent / ".env"

def load_env():
    """Load environment variables from .env file."""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The load_env routine ingests every key-value pair from .env into the process environment without filtering. On its own this is common utility behavior, but paired with later subprocess inheritance it can disclose unrelated secrets to the external Bird CLI and expands the consequences of a compromised child tool.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 33)May include surrounding context.

python

BIRD_ENV = Path(__file__).parent.parent / ".env"

def load_env():
    """Load environment variables from .env file."""
    if BIRD_ENV.exists():
        for line in BIRD_ENV.read_text().splitlines():
            if '=' in line and not line.startswith('#'):

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The script copies the entire current environment and passes it to an external CLI, after explicitly loading variables from a local .env file into os.environ. This unnecessarily exposes all available secrets and tokens to a third-party executable, increasing the blast radius if that binary is compromised, replaced, or logs its environment.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 79)May include surrounding context.

python

for query in queries[:4]:  # Limit to avoid rate limits
        try:
            cmd = [BIRD_CLI, 'search', query, '-n', '10', '--json']
            env = os.environ.copy()
            
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This second call repeats the same pattern of forwarding the full inherited environment to an external program. In a skill that aggregates external content and relies on local credentials, this creates avoidable credential exposure to the subprocess and any downstream behavior of that tool.

Content

Scanner excerpt · scripts/rumor_scanner.py (reported line 132)May include surrounding context.

python

for query in queries[:3]:
        try:
            cmd = [BIRD_CLI, 'search', query, '-n', '15', '--json']
            env = os.environ.copy()
            
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The plan includes product analytics, error tracking, push notifications, and business metrics collection, but it does not pair those behaviors with explicit user-facing disclosure, consent flows, or data-minimization requirements. In a finance app that handles portfolios, alerts, and behavioral data, silent collection or transmission of telemetry can create privacy, compliance, and trust risks even if the underlying tooling is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs users to extract AUTH_TOKEN and CT0 session cookies from browser developer tools and store them in a local .env file. These are sensitive authentication artifacts, and encouraging manual extraction and local storage without strong warnings, scoping guidance, or safer alternatives increases the risk of account takeover if the tokens are exposed via shell history, logs, backups, malware, or accidental commits.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises shell, network, environment, and file read/write capabilities through its documented commands and local storage paths, but it does not declare any explicit tool scope or permissions boundary. This is dangerous because an orchestrator or user may invoke a much more capable skill than expected, increasing the risk of unintended file modification, data persistence, and outbound network access without clear review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation language is extremely broad and overlaps with many ordinary finance-related prompts, which can cause the skill to activate in contexts the user did not intend. Because the skill can perform network access, shell execution, and persistent local writes, overbroad triggering raises the chance of unnecessary data collection, command execution, or modification of local financial tracking files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown documents persistent storage of portfolio and watchlist data under the user's home directory but does not clearly warn that commands will write sensitive financial tracking information to local files. This is dangerous because users may unknowingly persist investment interests, holdings, cost basis, and alert thresholds on disk, creating privacy and confidentiality risk on shared or monitored systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document prominently frames the tool as producing clear BUY/HOLD/SELL signals and recommendations before presenting strong financial-risk caveats, which can encourage overreliance on the system for investment decisions. In a stock-analysis skill, this is especially sensitive because users may act on outputs involving real financial loss, and the later disclaimer ('not financial advice') may be insufficient to counter the prescriptive framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation tells users to grant Terminal Full Disk Access and obtain live Twitter/X session material without clearly warning that these are highly sensitive credentials and privacy-impacting permissions. This can lead users to expose active account tokens or broaden local system access in ways that increase the blast radius if the machine, shell history, logs, or project files are later compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.