ClawHub
Back to skill

Security audit

sunzi-war-strategy

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed A-share trading analysis helper; it gives risky financial guidance, but it does not hide behavior, persist access, use credentials, or execute trades.

Install only if you want an educational trading-analysis framework. It can produce direct buy/sell and position-size suggestions, so do not treat outputs as personalized investment advice or as a guarantee of performance; verify data, consider your own risk tolerance, and avoid connecting it to any trading workflow without separate safeguards.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The file provides concrete trading rules, position sizing, entry/exit criteria, and buy/sell decision logic, but it contains no warning that financial trading can cause significant losses and that the content is not personalized investment advice. In the context of a skill explicitly designed to output trading diagnoses and decisions for A-shares, this omission increases the chance that users treat the strategy as authoritative and act on it without understanding risk, suitability, or market uncertainty.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script outputs explicit trading verdicts and portfolio sizing guidance such as '可重仓出击' and '≤20% 总仓' without any disclaimer, suitability checks, or warning that the result is heuristic and not financial advice. In a trading skill, this increases the chance that users treat the output as authoritative and make real-money decisions based on incomplete or misleading signals.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.