T08 · Insecure Dependencies
Warning
- Location
requirements.txt:9- Finding
Invalid dependency hashes combined with ineffective installation verification
- Content
View full analysis
- Remediation
View remediation
Security audit
research analyst
Security checks for vulnerabilities and agentic risk
Overview
This finance-analysis skill mostly matches its purpose, but its dependency verification claims and local portfolio storage need careful review before installation.
Review requirements.txt before installing, prefer a fresh virtual environment, and do not bypass hash failures by deleting hashes unless you independently trust the packages. If you use portfolio tracking, treat the stored portfolios.json as private financial data and keep CLAWDBOT_STATE_DIR in a directory only your user can read or write.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/portfolio_manager.py:43- Finding
Portfolio data and temporary files are created without explicit access restrictions
- Content
View full analysis
Path: """Get the portfolio storage path.""" # Use ~/.clawdbot/skills/research-analyst/portfolios.json state_dir = os.environ.get("CLAWDBOT_STATE_DIR", os.path.expanduser("~/.clawdbot")) portfolio_dir = Path(state_dir) / "skills" / "research-analyst" portfolio_dir.mkdir(parents=True, exist_ok=True) return portfolio_dir / "portfolios.json" ``` `scripts/portfolio_manager.py:91-110`: ```python def _acquire_lock(self, timeout: float = 5.0) -> bool: """Acquire a file lock with timeout.""" start_time = time.time() while time.time() - start_time < timeout: try: # Try to create lock file exclusively with open(self._lock_path, "x") as f: f.write(str(os.getpid())) return True except FileExistsError: # Lock exists, wait and retry time.sleep(0.1) return False def _release_lock(self) -> None: """Release the file lock.""" try: if self._lock_path.exists(): self._lock_path.unlink() except Exception: pass # Best effort cleanup ``` `scripts/portfolio_manager.py:133-151`: ```python def _save(self) -> None: """Save portfolios to disk with atomic write and file locking.""" if self._data is None: return # Acquire lock before writing if not self._acquire_lock(): raise RuntimeError("Could not acquire file lock after timeout") try: # Ensure directory exists self.path.parent.mkdir(parents=True, exist_ok=True) # Atomic write: write to temp file, then rename tmp_path = se ...[truncated 3121 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
Findings (35)
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md - ❌ Execute subprocess calls - ❌ Modify system files or cron - ❌ Require credentials or API keys - ❌ Upload data to external servers - ❌ Use eval/exec for dynamic code execution - ❌ Install additional packages at runtime
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code does use a public API library (yfinance), does not use credentials, and does not spawn subprocesses, which aligns with parts of the description. However, its primary behavior is not merely minimal local stock/crypto analysis: it is a stateful portfolio management tool with CRUD operations for portfolios and holdings, persisting data to local files under the user's home/state directory. That is a materially broader and different capability than the declared purpose, and the description omits the filesystem persistence and management features entirely. Therefore this is a description/behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The core description is partly accurate: this script does perform stock and crypto analysis, uses read-only public market data, and does not use credentials or subprocesses. However, the code materially exceeds the declared 'minimal local stock/crypto analysis' scope by supporting portfolio analysis through a separate portfolio_manager module and by integrating additional local modules such as cn_stock_quotes for Chinese-market fallback. Those are meaningful capabilities/resources not disclosed in the declared purpose. Also, the script includes sentiment/options-chain analysis paths and market-wide context features that go beyond a narrowly described minimal analyzer. Separately, the header/documentation claims Google News breaking-news analysis, but in this code that feature is stubbed out and returns None, showing description/behavior inconsistency. Overall, the primary purpose is related, but the declared description does not accurately represent all meaningful capabilities and accessed resources.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The code chunk does not implement stock or crypto analysis at all; its primary purpose is installation and bundle verification. It runs as a bash script, invokes system commands (e.g., python3, awk, grep, find, wc), and scans the local filesystem for files and code patterns. That is materially different from the declared purpose of a minimal local analysis skill. While some checks are framed as validating claims like '5 core scripts' and 'no subprocess,' the actual behavior shown is still an undeclared verification/auditing utility rather than analysis functionality. Therefore this is a description-behavior mismatch.
- Content
Known Vulnerable Dependency: lxml==5.1.0 — 2 advisory(ies): CVE-2026-41066 (lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to); CVE-2026-41066 (lxml is a library for processing XML and HTML in the Python language. Prior to 6)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
lxml==5.1.0 is flagged for XXE-related parser weaknesses in default configurations for certain XML parsing modes. In a skill that fetches and parses external market or finance data, any XML parsing of untrusted remote content could enable file disclosure, SSRF, or parser abuse if insecure parser defaults are used.
- Content
Known Vulnerable Dependency: soupsieve==2.5 — 4 advisory(ies): CVE-2026-49476 (Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists); CVE-2026-49477 (Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser); CVE-2026-49476 (Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists) +1 more
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
soupsieve==2.5 has reported denial-of-service style issues such as memory exhaustion and regex/parser abuse on crafted selectors. As a transitive dependency of BeautifulSoup, risk depends on whether attacker-controlled selectors are ever processed, but retaining a known-vulnerable parser component can still expose the skill to resource exhaustion in edge cases.
- Content
Known Vulnerable Dependency: idna==3.6 — 4 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2024-3651 (Internationalized Domain Names in Applications (IDNA) vulnerable to denial of se); CVE-2024-3651 (A vulnerability was identified in the kjd/idna library, specifically within the ) +1 more
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
idna==3.6 is flagged for denial-of-service and crafted-input handling issues in internationalized domain name processing. Because this skill uses HTTP libraries and may consume remote URLs or hostnames from public data sources, malformed IDN input could potentially trigger resolution or parsing weaknesses in upstream request flows.
- Content
Known Vulnerable Dependency: urllib3==2.1.0 — 12 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +9 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
urllib3==2.1.0 is a core transport dependency and the cited advisories include cross-origin header leakage and decompression/streaming issues. In a tool built around fetching stock/crypto data from public endpoints, a vulnerable HTTP transport layer is especially relevant because malformed responses, redirects, or proxy interactions could directly reach the affected code paths.
- Content
Known Vulnerable Dependency: certifi==2024.2.2 — 2 advisory(ies): CVE-2024-39689 (Certifi removes GLOBALTRUST root certificate); CVE-2024-39689 (Certifi is a curated collection of Root Certificates for validating the trustwor)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `stock_analyzer.py` | 99KB | 8-dimension stock/crypto analysis |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Permission Errors
bash mkdir -p ~/.clawdbot/skills/research-analyst/ ls -la ~/.clawdbot/skills/research-analyst/
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
Permission Errors
bash mkdir -p ~/.clawdbot/skills/research-analyst/ ls -la ~/.clawdbot/skills/research-analyst/API Rate Limits
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - ❌ Download external code (all bundled) - ❌ Execute subprocess calls - ❌ Modify system files or cron - ❌ Require credentials or API keys - ❌ Upload data to external servers - ❌ Use eval/exec for dynamic code execution
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - ❌ Execute subprocess calls - ❌ Modify system files or cron - ❌ Require credentials or API keys - ❌ Upload data to external servers - ❌ Use eval/exec for dynamic code execution - ❌ Install additional packages at runtime
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more
Medium
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The requirements pin requests==2.31.0, and the cited advisories include real security issues affecting URL handling, session verification behavior, and ancillary helper functionality. Even though this file is only a dependency manifest and the skill claims to use only public APIs, a network-facing research tool commonly performs outbound HTTP requests, so keeping a known-vulnerable HTTP client increases exposure to credential leakage, TLS verification edge cases, or other request-layer abuse if code paths trigger the affected behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The code and comments indicate the skill is specifically tailored to A-share and Hong Kong Chinese market data, and line L010 hardcodes Chinese field labels in comments. Under the policy rule for natural-language locale violations, this reflects a fixed language/locale assumption without offering a user choice or documenting opt-in.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill manifest frames the capability as minimal analysis, while this file implements a full CRUD portfolio manager that stores and mutates user portfolio data on disk. Persistent portfolio tracking is a broader behavior than read-only local analysis and is not reflected in the manifest description.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python Portfolio management for research-analyst skill. Usage: python3 portfolio_manager.py create "Portfolio Name" python3 portfolio_manager.py list python3 portfolio_manager.py show [--portfolio NAME] python3 portfolio_manager.py delete "Portfolio Name"
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- verify_install.sh:66