Openclaw Quant Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 0.1.0

Overview

This package mixes a crypto trading skill with an unrelated video-generation skill and asks users to install mutable external code while handling API keys and possible live trading.

Review carefully before installing. Use only the quant documentation unless the publisher fixes or removes the unrelated English video-generator file. If you proceed, install in an isolated environment, pin and inspect the exact repository commit first, avoid global installs, keep API keys out of shell history and chats, disable withdrawals on exchange keys, prefer testnet or paper trading, and require explicit confirmation before any live trading.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24

Finding

Mutable Quantitative-Trading Repository and Dependencies Are Retrieved and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

``` 2. Publish and verify signed release tags. 3. Provide an expected commit identifier and cryptographic checksum through a trusted channel. 4. Lock every Python dependency, including transitive dependencies, to reviewed versions. 5. Generate a hash-locked requirements file and install with: ```bash pip install --require-hashes -r requirements.lock ``` 6. Install into a dedicated virtual environment rather than the user's global Python environment. 7. Perform installation before exposing exchange credentials to the process. 8. Use exchange API keys restricted to required symbols and trading operations, with withdrawals disabled. 9. Default to testnet or paper trading; require explicit confirmation before enabling live trading. 10. Include the executable implementation in the audited artifact, or independently audit the exact pinned external release. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL-EN.md:25

Finding

Video Generator Retrieves and Installs Mutable Remote Code and npm Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL-EN.md:1

Finding

English Skill Variant Has a Different Identity and Functionality Than the Primary and Chinese Variants

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is for a video-generation skill, while the declared skill metadata says this package is a cryptocurrency quantitative trading system. That mismatch is a strong indicator of skill repurposing or package confusion that could cause an agent to perform unrelated external actions, undermining operator expectations and trust boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to clone an external GitHub repository, install dependencies, and configure credentials for a completely unrelated project. In the context of a purported crypto trading skill, this is unjustified remote code acquisition and setup guidance that could lead to supply-chain compromise or unauthorized environment changes.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-trigger rules are broad enough to match ordinary discussion about videos or scripts, causing the skill to activate without clear user intent. In a mismatched skill package that also leads to shell execution and external API use, broad triggering materially increases the chance of accidental invocation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file directs agents to execute shell commands that invoke local scripts, pnpm exec tsx, and other media-generation tooling unrelated to cryptocurrency trading. This expands the agent's behavior into arbitrary external execution and network/API usage outside the declared purpose, creating a strong risk of unintended or deceptive action.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples classify common descriptive text as a mandatory signal to invoke the skill, which is ambiguous and can override user intent. This is especially dangerous here because the skill is already out of scope for the advertised package and could trigger unrelated code execution paths.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-EN.md (reported line 311)May include surrounding context.

md

**DON'T**:
- ❌ Run `npx remotion` to create new projects
- ❌ Assume project is installed without checking
- ❌ Ignore error messages
- ❌ Use hardcoded absolute paths (except `~` paths)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill prominently advertises live automated trading at the top-level description without an equally prominent upfront risk warning. In a financial automation context, this is dangerous because users may engage with real-money trading before seeing later caveats, which increases the likelihood of loss, misuse of API credentials, and misunderstanding that live execution requires explicit informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The auto-trigger rules use broad terms such as '量化' and '交易策略', which can overlap with ordinary conversation and cause the skill to activate unintentionally. In this skill's context, accidental activation is more dangerous because the skill can progress from analysis into paper trading or even live trading workflows, increasing the chance of risky financial actions being initiated from an ambiguous user request.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Earlier sections describe the skill as already supporting live trading, including manifest text at L003, feature list at L048, examples at L165-L179, and CLI usage at L197-L198. The roadmap then states '版本 0.3.0' will add live trading, which directly conflicts with the documented current behavior and creates intent uncertainty about whether real trading is actually available now.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to export exchange API credentials and enables live trading, but it does not clearly warn that secrets may be exposed through shell history, logs, screenshots, shared terminals, or by being passed into agent workflows that inspect environment variables. In the context of a trading skill, leaked credentials can lead to unauthorized account access and potentially real financial loss, especially if withdrawal or trading permissions are enabled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.