Skill Trust Decision
fin-advisor
A legitimate fund investment advisor skill with documented behavior, no malicious indicators, and only minor tool-permission gaps and undeclared external service calls.
Why this conclusion was reached
1/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
2 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
What drove the risk score up
Tool mismatch — Edit used but not declared in allowed-tools +10
SKILL.md instructs the agent to use Edit to update USER.md, but allowed-tools only lists Read and Bash. This is a doc-to-code mismatch for a permission-related action.
Undeclared network egress via slot-filling service +5
scripts/slot-filling.sh makes HTTP POST requests to SLOT_SERVICE_URL (a user-provided external endpoint) with the query string. This is Bash/network behavior not declared in allowed-tools.
External URLs in skill-card.md +5
References to clawhub.ai external URLs — low-risk branding links, not indicators of malicious behavior.
Most important evidence
Medium Doc Mismatch
Edit tool used but not declared in allowed-tools
SKILL.md instructs the agent to use Edit to update USER.md's persona_preference field, but allowed-tools only declares Read(*.md) and Bash(mcporter:*). Edit (filesystem:WRITE) is a missing declaration.
SKILL.md:29 Add Edit to allowed-tools or restructure USER.md updates to use Bash/echo if Read-only is intentional.
Low Sensitive Access
Undeclared external HTTP POST via slot-filling service
scripts/slot-filling.sh makes HTTP POST requests to a user-provided SLOT_SERVICE_URL with the query text and authorization header. This is indirect network egress via Bash/curl, not declared in allowed-tools.
scripts/slot-filling.sh:70 Document the slot-filling external service call in SKILL.md's allowed-tools section or add network:READ to the capability map. skill-card.md partially discloses this risk.
Low Priv Escalation
Workspace filesystem write scope not declared
SKILL.md references writing to 'workspace 目录下的 USER.md' and 'workspace目录', implying filesystem:WRITE access to the workspace, but allowed-tools only lists Read(*.md).
SKILL.md:17 Clarify workspace write scope in allowed-tools if direct file writes are expected beyond USER.md preferences.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
allowed-tools: Bash(mcporter:*) — restricted to mcporter calls Filesystem Block
Declared READ
→ Inferred READ+WRITE
allowed-tools declares only Read(*.md), but SKILL.md instructs Edit to modify USER.md (filesystem:WRITE behavior) Network Pass
Declared NONE
→ Inferred READ (indirect)
scripts/slot-filling.sh uses curl to POST to SLOT_SERVICE_URL, but this is not declared in allowed-tools or SKILL.md Environment Pass
Declared NONE
→ Inferred NONE
No direct os.environ iteration or sensitive env access observed Skill Invoke Pass
Declared NONE
→ Inferred NONE
No inter-skill invocation or MCP tool chaining beyond mcporter Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access detected Browser Pass
Declared NONE
→ Inferred NONE
No browser tool usage Database Pass
Declared NONE
→ Inferred NONE
No database access detected Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/user/Lovelcp skill-card.md:7
Medium External URL
https://clawhub.ai/Lovelcp/fin-advisor skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| jq | system | system CLI | No | Standard CLI tool, version not pinned |
| curl | system | system CLI | No | Standard CLI tool used only for local slot-filling service calls |
| mcporter | external | external MCP tool | No | External MCP tool broker — capabilities scoped to fund data API, not controlled by this skill |
File composition
11 files · 729 lines
Markdown 9 files · 598 linesShell 1 files · 126 linesJSON 1 files · 5 lines
Files of concern · 3
SKILL.md Edit tool used but not declared in allowed-tools · Workspace filesystem write scope not declared
scripts/slot-filling.sh Undeclared external HTTP POST via slot-filling service
skill-card.md https://clawhub.ai/user/Lovelcp · https://clawhub.ai/Lovelcp/fin-advisor
Other files · tool-guide.md · domain-knowledge.md · output-guide.md · compliance.md · friendly.md · professional.md +2
Security positives
No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env, etc.)
No base64-encoded execution, eval(), or obfuscation techniques detected
No reverse shell, C2, or data exfiltration to untrusted endpoints
No curl|bash or wget|sh remote script execution
Comprehensive compliance rules for investment advice with mandatory risk disclaimers
skill-card.md discloses known risks (USER.md storage, external slot-filling service, investment advice scope) proactively
slot-filling.sh has mock mode and graceful failure handling — no hard failure on service unavailability
Strong data integrity constraints: four-element compliance for financial data, zero-calc principle, MCP-tool-only data sourcing
Dependencies are standard CLI tools (jq, curl, bash) with no external pip/npm packages
Script is a simple bash wrapper with parameterized inputs, no dynamic code generation