{ "skill_name": "base-trader", "skill_path": "/workspace/skills/clawhub-base-trader", "skill_directory": "/workspace/skills/clawhub-base-trader", "is_safe": false, "max_severity": "CRITICAL", "findings_count": 12, "findings": [ { "id": "MANIFEST_MISSING_LICENSE_c5ae9be793", "rule_id": "MANIFEST_MISSING_LICENSE", "category": "policy_violation", "severity": "LOW", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)", "analyzer": "static", "metadata": { "meta_reviewed": true } }, { "id": "COMMAND_INJECTION_USER_INPUT_0c4e0799df", "rule_id": "COMMAND_INJECTION_USER_INPUT", "category": "command_injection", "severity": "MEDIUM", "title": "User input used in command substitution - potential injection risk", "description": "Pattern detected: $(dirname \"$0\")", "file_path": "scripts/log-trade.sh", "line_number": 12, "snippet": "TRADES_FILE=\"$(dirname \"$0\")/../data/trades.json\"", "remediation": "Validate and sanitize all user inputs before using in commands", "analyzer": "static", "metadata": { "matched_pattern": "\\$\\([^)]*\\$[0-9]+[^)]*\\)", "matched_text": "$(dirname \"$0\")", "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "scanner_category": "INJECTION ATTACK", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_0", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Hardcoded Credential Path Exposure", "description": "The skill hardcodes the path to Bankr API credentials at ~/.clawdbot/skills/bankr/config.json and references this configuration file multiple times. This creates a risk of credential exposure if the skill or its logs are shared, and establishes a predictable target for credential theft.", "file_path": "SKILL.md", "line_number": 13, "snippet": "Bankr API configured at `~/.clawdbot/skills/bankr/config.json`", "remediation": "Use environment variables or secure credential management systems instead of hardcoded file paths. Implement credential validation without exposing the storage location. Add warnings about protecting credential files.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Poisoning/External Dependency Risk", "Command Injection", "Unbounded Automation/Resource Abuse", "Deceptive Content/Misleading Risk Framing" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_1", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "HIGH", "title": "External Tool Dependency Without Verification", "description": "The skill depends entirely on an external 'bankr' tool located at ~/clawd/skills/bankr/scripts/bankr.sh with no verification of its integrity, authenticity, or behavior. All trading commands are passed directly to this external script, creating a tool poisoning risk where a compromised or malicious bankr tool could execute arbitrary actions.", "file_path": "scripts/check-portfolio.sh", "line_number": null, "snippet": "BANKR_SCRIPT=\"$HOME/clawd/skills/bankr/scripts/bankr.sh\"\nif [ ! -f \"$BANKR_SCRIPT\" ]; then", "remediation": "Implement cryptographic verification of the bankr tool (signature checking, hash validation). Add version pinning and integrity checks. Provide clear warnings about the external dependency and its security implications. Consider sandboxing or limiting the bankr tool's capabilities.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Poisoning/External Dependency Risk", "Command Injection", "Unbounded Automation/Resource Abuse", "Deceptive Content/Misleading Risk Framing" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_2", "rule_id": "LLM_COMMAND_INJECTION", "category": "command_injection", "severity": "HIGH", "title": "Command Injection via Unvalidated Trade Parameters", "description": "The log-trade.sh script accepts user-controlled parameters ($1-$6) and uses them directly in shell commands and JSON construction without validation or sanitization. Parameters like TOKEN, REASON, and TX could contain shell metacharacters or JSON injection payloads.", "file_path": "scripts/log-trade.sh", "line_number": null, "snippet": "ACTION=$1\nTOKEN=$2\nAMOUNT_USD=$3\nPRICE=$4\nREASON=$5\nTX=$6", "remediation": "Implement strict input validation for all parameters. Use proper JSON escaping (jq --arg for safe variable interpolation). Validate that ACTION is one of allowed values (BUY/SELL). Sanitize TOKEN names against a whitelist pattern. Validate numeric inputs (AMOUNT_USD, PRICE).", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Poisoning/External Dependency Risk", "Command Injection", "Unbounded Automation/Resource Abuse", "Deceptive Content/Misleading Risk Framing" ], "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "aisubtech": "AISubtech-9.1.4", "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)", "scanner_category": "INJECTION ATTACK", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_3", "rule_id": "LLM_RESOURCE_ABUSE", "category": "resource_abuse", "severity": "HIGH", "title": "Unbounded Automated Trading Without Circuit Breakers", "description": "The skill promotes automated trading strategies (DCA, limit orders, stop losses) but lacks implementation of the stated safety limits. The instructions mention 'MAX_DAILY_LOSS = -20%' and 'STOP TRADING FOR 24 HOURS' but provide no mechanism to enforce these limits, allowing unbounded automated execution that could drain funds.", "file_path": "SKILL.md", "line_number": null, "snippet": "MAX_POSITION_SIZE = 10% of portfolio\nMAX_SINGLE_TRADE = $50 USD\nSTOP_LOSS = -15% from entry\nTAKE_PROFIT = +30% minimum target\nMAX_DAILY_LOSS = -20% of starting balance\n\nIf daily loss limit hit \u2192 STOP TRADING FOR 24 HOURS.", "remediation": "Implement actual enforcement mechanisms for stated limits. Add portfolio tracking to calculate daily P&L. Create a circuit breaker that prevents trading when limits are exceeded. Store state to persist limits across sessions. Add mandatory confirmation for trades approaching limits.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Poisoning/External Dependency Risk", "Command Injection", "Unbounded Automation/Resource Abuse", "Deceptive Content/Misleading Risk Framing" ], "aitech": "AITech-13.3", "aitech_name": "Availability Disruption", "aisubtech": "AISubtech-13.3.2", "aisubtech_name": "Compute Exhaustion", "scanner_category": "RESOURCE ABUSE", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_4", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "HIGH", "title": "Deceptive Risk Framing and Gambling Promotion", "description": "The skill presents high-risk cryptocurrency trading and 'launch sniping' (buying newly launched tokens) as systematic strategies, while acknowledging '90%+ of launches are rugs or scams' and '8 out of 10 snipes: Lose 50-100%'. The framing uses professional trading terminology to legitimize what is effectively gambling with extremely poor odds, potentially misleading users about the true risk.", "file_path": "references/launch-sniping.md", "line_number": null, "snippet": "Expected Outcomes\n- 8 out of 10 snipes: Lose 50-100%\n- 1 out of 10 snipes: Break even or small profit\n- 1 out of 10 snipes: 5-20x gain", "remediation": "Add prominent warnings about the gambling nature of these activities. Clearly state expected value calculations showing negative returns. Require explicit user acknowledgment of risks before enabling trading features. Consider removing or heavily restricting 'launch sniping' functionality.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL and HIGH severity security risks. The primary concerns are: (1) hardcoded credential paths creating exposure risk, (2) complete dependency on an unverified external trading tool (bankr) enabling tool poisoning, (3) command injection vulnerabilities in parameter handling, (4) lack of enforcement for stated safety limits allowing unbounded automated trading, and (5) deceptive framing of high-risk gambling as systematic trading. The skill handles financial transactions and credentials but lacks fundamental security controls like input validation, credential protection, and circuit breakers. The automated trading features could lead to significant financial loss if exploited or if the external bankr tool is compromised. The 'launch sniping' functionality promotes extremely high-risk behavior (80% expected loss rate) with inadequate warnings. Immediate remediation is required before this skill should be used in any production environment.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Poisoning/External Dependency Risk", "Command Injection", "Unbounded Automation/Resource Abuse", "Deceptive Content/Misleading Risk Framing" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_reviewed": true } }, { "id": "llm_finding_base-trader_5", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Sensitive Financial Data Logging Without Protection", "description": "The skill logs all trades including amounts, tokens, reasons, and transaction hashes to data/trades.json without encryption or access controls. This creates a persistent record of financial activity that could be exposed through file system access, backups, or skill sharing.", "file_path": "scripts/log-trade.sh", "line_number": null, "snippet": "TRADES_FILE=\"$(dirname \"$0\")/../data/trades.json\"\n...\nTRADE=$(cat <