Quant Analyst

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:37 AM UTC
• Version: 0.1.1

Overview

This package mixes a cryptocurrency trading skill with an unrelated video-generation skill file and asks users to run unpinned external code with sensitive API credentials.

Review this carefully before installing. Do not use production exchange credentials unless the package is corrected, live-trading behavior is clearly scoped, and keys are least-privilege, withdrawal-disabled, IP-restricted, and preferably testnet first. The publisher should remove or separate the video-generator file, pin reviewed repository commits and dependencies, and avoid shell-interpolating user content.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20
• Finding: Unpinned Remote Payload Retrieval and Dependency Execution<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 20-29 - `SKILL-ZH.md`, lines 20-29 - `SKILL-EN.md`, lines 23-34 **Vulnerability Type**: Remote code retrieval and unsafe supply-chain execution **Risk Level**: High ### Vulnerable Code From `SKILL.md` and `SKILL-ZH.md`: ```bash # Clone repository git clone https://github.com/ZhenRobotics/openclaw-quant.git ~/openclaw-quant cd ~/openclaw-quant # Install dependencies pip install -r requirements.txt # Set API keys (optional for backtesting) export BINANCE_API_KEY="your-key" export BINANCE_API_SECRET="your-secret" ``` From `SKILL-EN.md`: ```bash # Clone to standard location git clone https://github.com/ZhenRobotics/openclaw-video.git ~/openclaw-video cd ~/openclaw-video # Install dependencies npm install # Set API key export OPENAI_API_KEY="sk-your-key-here" ``` ### Technical Analysis The Skill package does not include the implementations it instructs the agent to execute. Instead, it clones the current default branch of external GitHub repositories and installs dependencies defined by those repositories. No audited commit, release artifact, cryptographic checksum, or signature is specified. Consequently, the effective payload can change after this Skill has been reviewed. A compromised repository, maintainer account, dependency manifest, or transitive dependency could introduce arbitrary code. Both Python and npm installation processes may execute package-controlled build or installation logic. Subsequent documented commands also execute scripts from the downloaded repositories. The risk is amplified because users are instructed to export sensitive exchange or OpenAI credentials in the same environment. Although remote exchange and OpenAI API access are necessary for the declared live-trading and cloud video-generation features, downloading mutable implementation code is not the minimum privilege required for those network operations. ### Attack Path 1. An attacker compromises ...[truncated 1460 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each external repository to a specific reviewed commit hash rather than cloning and executing the default branch. 2. Prefer signed release artifacts and verify their signatures or published SHA-256 checksums before installation. 3. Pin exact dependency versions: - Use hash-locked Python requirements, such as `pip install --require-hashes`. - Commit and enforce an npm lockfile with `npm ci` instead of an unconstrained `npm install`. 4. Review dependency manifests and installation hooks before execution. 5. Disable package lifecycle scripts where feasible, for example with `npm ci --ignore-scripts`, and explicitly run only reviewed build steps. 6. Perform installation and execution in a sandbox, container, or dedicated low-privilege account. 7. Keep credentials unavailable during installation. Inject narrowly scoped credentials only into the final reviewed runtime process. 8. Use exchange API keys that disable withdrawals, restrict permitted operations, and enforce IP allowlists. 9. Separate backtesting, paper-trading, and live-trading permissions so offline functionality never receives live exchange credentials. 10. Vendor or bundle the reviewed implementation with the Skill when practical so the audited package corresponds to the executed code. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL-EN.md:81
• Finding: Shell Command Injection Through Interpolated Video Script Content<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL-EN.md`, lines 81-91 - `SKILL-EN.md`, lines 161-169 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code Primary generation instructions: ```bash # Method 1: Convenience script (Recommended) ~/openclaw-video/generate-for-openclaw.sh "user's script content" # Method 2: CLI cd ~/openclaw-video && ./agents/video-cli.sh generate "script content" # Method 3: Full Agent (for complex requests) cd ~/openclaw-video && pnpm exec tsx agents/video-agent.ts "generate video: script content" ``` Configured generation example: ```bash cd ~/openclaw-video && ./agents/video-cli.sh generate "script content" --voice nova --speed 1.3 ``` ### Technical Analysis The instructions direct an agent to insert arbitrary user-supplied video script content into a shell command enclosed in double quotes. Double quotes do not neutralize all shell syntax. Embedded double quotes can terminate the intended argument, while command substitution constructs such as `$(...)` and backticks may be evaluated inside double-quoted shell strings. If the agent builds a command string from the documented template and passes it to a shell, attacker-controlled content can escape the intended argument boundary or trigger command substitution. Merely validating that the input resembles a video script would not reliably prevent this vulnerability. The problem is avoidable because video text can be passed as a literal process argument, through standard input, or through an input file without invoking shell parsing. ### Attack Path 1. An attacker submits a video-generation request containing shell syntax within the purported script. 2. The agent substitutes the complete text into one of the documented shell command templates. 3. The command is interpreted by a shell rather than passed directly as a literal argument array. 4. Embedded command substitution or quote-breaking syntax is evaluated by the shell. 5. ...[truncated 1234 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate user content into a shell command string. 2. Invoke the executable through a process API that accepts an argument array and disables shell evaluation. For example, use Node.js `spawn` or `execFile` with `shell: false`. 3. Prefer passing long or untrusted script content through standard input or a securely created input file. 4. If a temporary file is used: - Create it with restrictive permissions. - Use an unpredictable name. - Avoid shared unsafe directories where possible. - Delete it after processing. 5. Ensure every layer, including wrapper scripts such as `generate-for-openclaw.sh`, preserves argument boundaries using quoted positional parameters such as `"$1"` and never uses `eval`. 6. Apply input size limits and reject control characters not required by the video-generation format. 7. Do not rely on blacklists of shell metacharacters as the primary defense. 8. Run video generation in a sandbox with minimal filesystem and network access. 9. Expose the OpenAI credential only to the specific API client process, and use a restricted project key with spending limits. 10. Add automated tests using inputs containing quotes, dollar signs, command substitutions, backticks, newlines, and shell metacharacters to verify they remain literal text. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Introducing Git clone, package installation, API-key handling, and shell execution into a quantitative trading skill is unjustified and materially expands the agent's privileges. In context, this looks like capability smuggling: a user invoking a finance-related skill could be induced to fetch and run unrelated third-party code, exposing the host to supply-chain compromise, secret leakage, or arbitrary code execution.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The auto-trigger rules match broad terms like 'video' or generic multi-sentence text, making accidental activation likely. In a mismatched skill that executes external projects, broad triggering increases the chance that ordinary conversation routes into shell commands and network actions without informed user intent.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill metadata says this is a cryptocurrency quantitative trading skill, but the content is a video-generation workflow that directs the agent to clone a GitHub repository, install dependencies, set API keys, and execute local shell scripts. This mismatch is dangerous because it can smuggle unrelated code-execution capabilities past users and policy boundaries under a trusted skill identity.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The examples say to 'always use this skill' for broad phrases, which encourages over-selection without verifying user intent or task fit. In this file's context, that can steer benign requests into an unrelated external-code execution workflow, increasing exposure to unsafe actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**DON'T**:
- ❌ Run `npx remotion` to create new projects
- ❌ Assume project is installed without checking
- ❌ Ignore error messages
- ❌ Use hardcoded absolute paths (except `~` paths)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: 触发关键词中包含“量化”“交易策略”等较宽泛表述，容易在用户仅讨论分析、教育或一般市场信息时误激活该技能。由于该 skill 涉及回测、模拟盘乃至实盘交易，误触发可能导致代理进入高风险金融操作流程、请求敏感 API 凭据，或在上下文不足时给出不恰当的交易执行建议。

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The document repeatedly describes paper trading, parameter optimization, and live trading as available current features, with usage examples and CLI commands at L44-L53, L149-L179, and L187-L199. However, the roadmap at L490-L503 says those same capabilities arrive only in later versions, creating an active contradiction in the skill's own stated intent and availability.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installation guide instructs users to export real Binance API credentials directly into their shell environment without an immediate warning about secret handling, scope restriction, or use of testnet/least-privilege keys. In a trading skill that also supports live trading, this increases the chance that users expose production credentials to shell history, logs, screenshots, shared terminals, or later agent/tool access.

Static analysis

No suspicious patterns detected.