ClawHub
Back to skill

Security audit

Claw Future

Security checks across malware telemetry and agentic risk

Overview

This is a coherent futures-trading skill, but it needs Review because it can control a real trading account through a background local daemon with broad activation and automatic order features.

Install only if you intentionally want an agent-operated CTP futures trading assistant. Test with SimNow or a small non-production account first, review the code and build scripts, protect config.json because it stores broker credentials, and do not leave the daemon running unless you are comfortable with local processes being able to issue trading commands to it. Be especially cautious with condition orders and scheduled orders, since they can execute without another user prompt once created.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
full_cmd = f'cmd /c ""{vcvars}" >nul 2>&1 && {cl_cmd}"'

    print("[INFO] 编译 ctp_bridge.dll ...")
    ret = subprocess.call(full_cmd, shell=True)
    if ret != 0:
        sys.exit("[ERROR] 编译失败")
Confidence
92% confidence
Finding
ret = subprocess.call(full_cmd, shell=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if b"\r\n" in raw:
            script_path.write_bytes(raw.replace(b"\r\n", b"\n"))

    result = subprocess.run(cmd)
    if result.returncode != 0:
        raise RuntimeError(
            f"ctp_bridge 编译失败（exit={result.returncode}）。\n"
Confidence
92% confidence
Finding
result = subprocess.run(cmd)

Tainted flow: 'full_cmd' from os.environ.get (line 75, credential/environment) → subprocess.call (code execution)

Medium
Category
Data Flow
Content
full_cmd = f'cmd /c ""{vcvars}" >nul 2>&1 && {cl_cmd}"'

    print("[INFO] 编译 ctp_bridge.dll ...")
    ret = subprocess.call(full_cmd, shell=True)
    if ret != 0:
        sys.exit("[ERROR] 编译失败")
Confidence
95% confidence
Finding
ret = subprocess.call(full_cmd, shell=True)

Context-Inappropriate Capability

Medium
Confidence
79% confidence
Finding
The skill exposes a local compile/build capability that executes OS-specific scripts, which extends beyond ordinary trading operations into arbitrary local code execution of bundled build logic. In an agent context, this increases attack surface because a prompt or workflow could trigger `setup` and run complex local scripts on the host, especially dangerous if the package contents or working environment are compromised.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The top-level description includes very broad phrases such as buy/sell/open/close, price, funds, positions, alerts, and daily report requests. In a conversational agent, these generic finance terms can cause accidental invocation in unrelated contexts, which is especially dangerous here because the skill can place orders and change trading state.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger lists around startup/account handling are permissive and overlap with ordinary conversation, increasing the chance the skill activates unexpectedly. In this skill, unintended activation is more severe than usual because it may silently run ping/poll on every invocation and can progress toward account access or trading actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The module loads the native library at import time, and if the file is absent it triggers automatic compilation and script execution without an explicit opt-in at the call site. Import-time execution is dangerous because merely importing the module can run local scripts unexpectedly, expanding the attack surface for supply-chain tampering and making review/containment harder. In a futures trading skill, compromise can directly affect funds, market actions, and sensitive operational secrets.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.