openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

optionns-trader v1.0.6 falsely flagged as suspicious — sys.path.insert in example file #187

New Issue
Open
opened 2026-02-15 17:16:06 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:06 -05:00
Owner
Copy Link
Copy Source

Originally created by @gigabit-eth on GitHub (Feb 15, 2026).

Skill Flag Review Request

Skill Information

Field Value
Name optionns-trader
Owner gigabit-eth
URL https://clawhub.ai/gigabit-eth/optionns-trader
Flagged version 1.0.6
Clean version 1.0.4 (passed scan)

What Happened

Version 1.0.6 was flagged as suspicious by ClawHub Security. The only change between 1.0.4 (clean) and 1.0.6 (flagged) was an update to examples/trading_agent.py.

What Triggered the Flag

The example file contained this pattern:

import sys
sys.path.insert(0, str(Path(__file__).parent.parent / 'scripts'))
from signer import sign_and_submit

This was used to import a local signer.py helper (which handles Solana transaction signing) from a sibling directory. We understand this matches heuristics for supply chain / import hijacking attacks, where malicious packages manipulate sys.path to load trojan modules.

Why This is a False Positive

  1. signer.py is part of our own skill package — it's not loading an external or shadowed module. The import target (scripts/signer.py) ships inside the same skill bundle.

  2. Self-custody design — signer.py signs transactions locally with the agent's own devnet keypair. No private key material is ever sent to the API or any external endpoint.

  3. Devnet only — the skill operates exclusively on Solana Devnet with mock USDC. The code includes runtime guards that reject non-devnet RPC URLs.

  4. No exfiltration — the skill sends only trade parameters (quote IDs, game IDs, public keys) to api.optionns.com. Private keys are never included in API calls.

Resolution

We've already fixed trading_agent.py in our next version to remove sys.path.insert entirely and instead call signer.py as a subprocess via its CLI interface:

# Before (flagged):
import sys
sys.path.insert(0, str(Path(__file__).parent.parent / 'scripts'))
from signer import sign_and_submit

# After (fixed):
result = subprocess.run(
    ["python3", str(self.signer_script), str(self.keypair_path), json.dumps(instructions), self.rpc_url],
    capture_output=True, text=True, timeout=60
)

Request

  1. Please review and unflag optionns-trader so the updated version can be published.

  2. If the sys.path.insert heuristic is the root cause, consider allowing it when the target path is within the skill's own package directory (relative path, no external reaches).

Contact

Originally created by @gigabit-eth on GitHub (Feb 15, 2026). # Skill Flag Review Request ## Skill Information | Field | Value | |-------|-------| | **Name** | `optionns-trader` | | **Owner** | `gigabit-eth` | | **URL** | https://clawhub.ai/gigabit-eth/optionns-trader | | **Flagged version** | `1.0.6` | | **Clean version** | `1.0.4` (passed scan) | ## What Happened Version `1.0.6` was flagged as suspicious by ClawHub Security. The only change between `1.0.4` (clean) and `1.0.6` (flagged) was an update to `examples/trading_agent.py`. ## What Triggered the Flag The example file contained this pattern: ```python import sys sys.path.insert(0, str(Path(__file__).parent.parent / 'scripts')) from signer import sign_and_submit ``` This was used to import a local `signer.py` helper (which handles Solana transaction signing) from a sibling directory. We understand this matches heuristics for supply chain / import hijacking attacks, where malicious packages manipulate `sys.path` to load trojan modules. ## Why This is a False Positive 1. **`signer.py` is part of our own skill package** — it's not loading an external or shadowed module. The import target (`scripts/signer.py`) ships inside the same skill bundle. 2. **Self-custody design** — `signer.py` signs transactions locally with the agent's own devnet keypair. No private key material is ever sent to the API or any external endpoint. 3. **Devnet only** — the skill operates exclusively on Solana Devnet with mock USDC. The code includes runtime guards that reject non-devnet RPC URLs. 4. **No exfiltration** — the skill sends only trade parameters (quote IDs, game IDs, public keys) to `api.optionns.com`. Private keys are never included in API calls. ## Resolution We've already fixed `trading_agent.py` in our next version to remove `sys.path.insert` entirely and instead call `signer.py` as a subprocess via its CLI interface: ```python # Before (flagged): import sys sys.path.insert(0, str(Path(__file__).parent.parent / 'scripts')) from signer import sign_and_submit # After (fixed): result = subprocess.run( ["python3", str(self.signer_script), str(self.keypair_path), json.dumps(instructions), self.rpc_url], capture_output=True, text=True, timeout=60 ) ``` ## Request 1. Please review and unflag `optionns-trader` so the updated version can be published. 2. If the `sys.path.insert` heuristic is the root cause, consider allowing it when the target path is within the skill's own package directory (relative path, no external reaches). ## Contact * **GitHub:** `gigabit-eth` * **Skill page:** https://clawhub.ai/gigabit-eth/optionns-trader
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#187
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?