ClawHub
Back to skill

Security audit

GLM-V-Stock-Analyst

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed stock analysis and report-generation skill with normal dependency and financial-advice risks, but no evidence of hidden, destructive, or exfiltrating behavior.

Install in a normal project sandbox or virtual environment. Expect it to contact market-data services, install Python packages, write stock_data_output reports, and open local report files. Treat investment conclusions as research only, do not provide unrelated secrets, and avoid sharing generated HTML if local path disclosure matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill directs the agent to execute shell commands and open local HTML files in a browser as part of normal operation. For a reporting skill, this is broader than necessary and can be abused to run unintended commands, expose local file paths, or render untrusted generated content in a browser context.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are very broad and overlap with ordinary conversational requests about companies, trends, or whether a stock is buyable. Overbroad triggering can cause the agent to invoke a high-capability skill unexpectedly, leading to unnecessary network access, shell execution, and file generation in contexts where a simple answer would suffice.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The file contains explicit market-timing and directional heuristics such as '连续多日大幅净买入通常是短期看涨信号' and 'MACD金叉...短期看涨' without any disclaimer that the material is informational only and not financial advice. In the context of a stock-analysis skill whose purpose is to analyze and predict price moves, these statements can be surfaced as prescriptive guidance and may encourage risky trading decisions or overconfident automated recommendations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 安装：pip install -r requirements.txt

# 核心数据源
akshare>=1.18.0
yfinance>=1.0.0
tushare>=1.4.0
Confidence
90% confidence
Finding
Using a lower-bound specifier for akshare allows future builds to resolve to newer, unreviewed versions, which can introduce supply-chain risk or unexpected breaking changes. In a skill that fetches external financial data and may run automatically, dependency drift increases the chance of silently pulling a compromised or vulnerable release.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 核心数据源
akshare>=1.18.0
yfinance>=1.0.0
tushare>=1.4.0

# 数据处理
Confidence
90% confidence
Finding
Using yfinance>=1.0.0 permits uncontrolled upgrades at install time, which is a classic software supply-chain weakness. Because this skill depends on network-retrieved market data, a malicious or compromised upstream package could affect execution or data handling.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 核心数据源
akshare>=1.18.0
yfinance>=1.0.0
tushare>=1.4.0

# 数据处理
pandas>=2.0.0
Confidence
90% confidence
Finding
tushare>=1.4.0 does not ensure reproducible installs and can pull in later versions with security defects or malicious code. This is especially relevant for an analytics skill that may process external data and credentials for third-party APIs.

Unpinned Dependencies

Low
Category
Supply Chain
Content
tushare>=1.4.0

# 数据处理
pandas>=2.0.0
numpy>=1.24.0

# 图表生成
Confidence
88% confidence
Finding
pandas>=2.0.0 allows any newer version, preventing reproducible builds and potentially introducing vulnerable releases without review. In a data-processing skill, unexpected parser or deserialization changes can expand attack surface when handling untrusted files or content.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 数据处理
pandas>=2.0.0
numpy>=1.24.0

# 图表生成
matplotlib>=3.7.0
Confidence
88% confidence
Finding
numpy>=1.24.0 is unpinned, so future installations may pull in versions with new security issues or regressions. Since numerical libraries are widely embedded in parsing and memory-heavy operations, version drift can create reliability and security exposure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.24.0

# 图表生成
matplotlib>=3.7.0

# PDF 处理（纯 Python，无需 poppler）
pymupdf>=1.23.0
Confidence
88% confidence
Finding
matplotlib>=3.7.0 permits uncontrolled upgrades and weakens build reproducibility. While not inherently dangerous alone, charting libraries process user-controlled labels and files, so dependency drift can expose the skill to future vulnerable versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
matplotlib>=3.7.0

# PDF 处理（纯 Python，无需 poppler）
pymupdf>=1.23.0

# 报告导出
fpdf2>=2.7.0
Confidence
90% confidence
Finding
pymupdf>=1.23.0 is unpinned and this library processes PDFs, a high-risk input class with a long history of parser vulnerabilities. In a skill that exports or may read report artifacts, allowing arbitrary future versions increases supply-chain and parser-risk exposure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pymupdf>=1.23.0

# 报告导出
fpdf2>=2.7.0
python-docx>=1.0.0
Pillow>=10.0.0
Confidence
90% confidence
Finding
fpdf2>=2.7.0 allows nondeterministic dependency resolution and may introduce vulnerable future releases into report generation workflows. Because document-generation libraries often handle embedded content, reproducibility matters for security review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 报告导出
fpdf2>=2.7.0
python-docx>=1.0.0
Pillow>=10.0.0

# MD→HTML 转换
Confidence
91% confidence
Finding
python-docx>=1.0.0 is unpinned and document-processing libraries frequently have parser-related security history. In this skill, report export features increase the relevance of controlling exact dependency versions to avoid vulnerable or malicious releases.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 报告导出
fpdf2>=2.7.0
python-docx>=1.0.0
Pillow>=10.0.0

# MD→HTML 转换
markdown>=3.6.0
Confidence
91% confidence
Finding
Pillow>=10.0.0 is unpinned, which is risky because image libraries regularly receive security fixes for malformed file handling. A multimodal/reporting skill may ingest or generate images, making exact version control more important.

Unpinned Dependencies

Low
Category
Supply Chain
Content
Pillow>=10.0.0

# MD→HTML 转换
markdown>=3.6.0

# 通用
requests>=2.31.0
Confidence
90% confidence
Finding
markdown>=3.6.0 permits future unreviewed versions that may contain parsing flaws or output-sanitization changes. Since this skill converts Markdown to HTML, parser behavior directly affects rendering safety and stability.

Unpinned Dependencies

Low
Category
Supply Chain
Content
markdown>=3.6.0

# 通用
requests>=2.31.0
Confidence
91% confidence
Finding
requests>=2.31.0 allows dependency drift in a core networking library, which can expose the skill to new SSRF, redirect, credential-leak, or TLS-handling flaws. Because the skill aggregates external financial data over the network, this package is security-relevant.

Known Vulnerable Dependency: markdown — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High
Category
Supply Chain
Confidence
80% confidence
Finding
The markdown dependency is used for Markdown-to-HTML conversion, and the requirement markdown>=3.6.0 could resolve to version 3.8, which the finding claims is affected by a parsing-related denial-of-service issue. Because this skill generates structured reports and may render user-influenced content, malformed input could cause crashes or service instability if a vulnerable version is installed.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
83% confidence
Finding
The requests requirement of >=2.31.0 can include later vulnerable releases, and the listed advisories are relevant to a network-heavy skill that fetches external market data. If a vulnerable version is resolved, issues such as credential leakage, redirect handling problems, or verification weaknesses could affect confidentiality and integrity of outbound requests.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.