ClawHub
Back to plugin

Security audit

openInvest

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent self-hosted investment assistant, but it handles sensitive portfolio data and optional credentials, so users should be careful with backups and write actions.

Install only if you want a local investment-record and analysis system to read and modify your portfolio ledger. Treat ~/openInvest, .env, and backup zip files as sensitive: restrict permissions, avoid sharing archives, and consider encrypting backups. Do not paste normal email passwords; use app passwords or skip email automation. Review any buy/sell/deposit/withdraw/import/restore action before allowing it, especially when connected to a remote hub.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The README suggests very generic trigger phrases such as 'set up invest', 'show my portfolio', and 'should I buy AAPL', which are natural-language requests a user may make in normal conversation. In an agent-skill ecosystem, broad triggers can cause unintended invocation of the skill, exposing portfolio data or initiating financial-analysis workflows when the user did not explicitly intend to activate this plugin.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly backs up and restores highly sensitive assets including `.env` and user profile data, which may contain API keys, SMTP credentials, and personal financial information, but it does not warn about handling, storage, transfer, or access control for the resulting backup archive. This creates a realistic risk that users will create unencrypted zip files, move them across machines, or store them in insecure locations, exposing secrets and private investment data if the archive is accessed by another local user or exfiltrated.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README advertises very broad natural-language triggers such as 'show portfolio', 'analyze X', and 'add to a position' without defining stricter activation boundaries or disambiguation rules. In an agent-skill ecosystem, this can cause the skill to activate on ordinary financial conversation and perform sensitive portfolio actions or external API calls when the user did not explicitly intend to invoke this skill.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill advertises very broad trigger phrases such as 'analyze X', 'track AAPL', and portfolio/P&L queries, which can overlap with ordinary conversation and cause the host agent to invoke this skill unexpectedly. Because the skill then directs the agent to run shell commands, access portfolio data, and possibly call remote APIs, accidental activation can lead to unintended data access or financial-action workflows without sufficiently clear user intent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill advertises activation via very broad natural-language phrases like "analyze X" and "should I buy/sell X," which are common in ordinary conversation and can unintentionally trigger a high-impact workflow involving shell commands, delegated subtasks, and persistence. In an interactive investment context, accidental invocation can cause the agent to run costly or sensitive analysis steps without the user clearly intending to launch this specific protocol, increasing the risk of unintended actions and data handling.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The onboarding flow asks the agent to collect a DeepSeek API key and Gmail App Password and paste them into a JSON payload, but it does not clearly warn the user that these are sensitive secrets that will be stored and processed locally. Users may disclose high-value credentials without understanding retention, logging, shell history, or who can later access the configured environment.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The example command pipes profile data and credentials directly through a shell invocation, increasing the risk that secrets are exposed via process inspection, terminal scrollback, copied transcripts, agent logs, or accidental persistence in command history/workflow artifacts. Even if stdin is safer than command-line flags, the documentation lacks warnings and safer handling guidance for secrets.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documentation presents multiple persistent write operations such as `deposit`, `withdraw`, `buy`, `sell`, `delete_holding`, and `import --commit` without a prominent safety warning or confirmation requirement. In an agent-driven environment, ambiguous user phrasing or autonomous tool use could cause unintended, durable modifications to portfolio state, cash balances, or holdings records.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The API section documents numerous state-changing endpoints that can alter trades, holdings, cash, and configuration, but does not clearly foreground that these calls persist changes to user records and portfolio state. In a skill intended for agent orchestration, that omission increases the risk of accidental writes, especially because some flows encourage direct recording and status updates that auto-sync holdings.

Credential Access

High
Category
Privilege Escalation
Content
BACKUP_DIR="$ROOT/.backups"
# 备份对象：git 完全不追踪、又不可再生的数据。db/*.sqlite-journal 等 WAL 临时
# 文件不带——那是运行时产物，恢复时会自动重建，带了反而可能是半提交状态。
INCLUDE_PATHS=(memory db .env user_profile.json user_profile.json.bak)
EXCLUDE_GLOBS=("*.pyc" "*.sqlite-journal" "*.db-shm" "*.db-wal" "*.lock")

usage() {
Confidence
89% confidence
Finding
The script explicitly includes `.env` in backup archives, which will package credentials and other secrets into a zip file under `$ROOT/.backups`. Although the likely intent is legitimate backup/restore, this increases secret exposure because zip archives are typically unencrypted, can be copied or exfiltrated easily, and may inherit broader access than the original secret file.

External Script Fetching

Low
Category
Supply Chain
Content
DEV_MODE="${OPENINVEST_DEV_MODE:-0}"

if ! command -v uvx >/dev/null 2>&1; then
    echo "❌ uv 未安装。装一下：curl -LsSf https://astral.sh/uv/install.sh | sh" >&2
    # mcp 模式 stdout 是 JSON-RPC 通道，错误 JSON 只在非 mcp 时输出
    [ "${1:-}" != "mcp" ] && echo '{"status":"error","error":"uv 未安装","hint":"运行 `curl -LsSf https://astral.sh/uv/install.sh | sh` 后重试"}'
    exit 1
Confidence
91% confidence
Finding
The script instructs users to install uv via 'curl ... | sh', which normalizes direct execution of remote code fetched over the network. If the remote host, TLS trust chain, or distribution path were compromised, a user following this guidance could execute attacker-controlled shell code.

External Script Fetching

Low
Category
Supply Chain
Content
if ! command -v uvx >/dev/null 2>&1; then
    echo "❌ uv 未安装。装一下：curl -LsSf https://astral.sh/uv/install.sh | sh" >&2
    # mcp 模式 stdout 是 JSON-RPC 通道，错误 JSON 只在非 mcp 时输出
    [ "${1:-}" != "mcp" ] && echo '{"status":"error","error":"uv 未安装","hint":"运行 `curl -LsSf https://astral.sh/uv/install.sh | sh` 后重试"}'
    exit 1
fi
Confidence
90% confidence
Finding
The JSON error hint repeats the same 'curl ... | sh' remote execution pattern, increasing the chance an automated agent or user copies and runs it without verification. In an agent skill context, prescriptive install commands are more dangerous because they may be surfaced programmatically and acted on with less scrutiny.

Static analysis

No suspicious patterns detected.