Backtester

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill does not show data theft or dangerous code, but it claims to perform real professional trading backtests while the included script only prints fixed, fake-looking results.

Install only if you want a simple placeholder/demo script. Do not rely on this skill for financial analysis or trading decisions unless the publisher supplies a real backtesting implementation and the documentation accurately describes what the code does.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI09: Human-Agent Trust Exploitation
Medium
What this means

A user could rely on the tool's results for trading decisions even though the included implementation does not perform real backtesting.

Why it was flagged

This presents the skill as a real financial analysis tool suitable for validating trading strategies, creating user trust in its outputs.

Skill content
Professional quantitative backtesting tool for validating trading strategies before live deployment.
Recommendation

Treat this as an unimplemented demo unless the maintainer provides real data loading, indicator calculation, trade simulation, and clear validation details.

#
ASI09: Human-Agent Trust Exploitation
Medium
What this means

The output can look like a legitimate backtest while being unrelated to the requested ticker, dates, or strategy performance.

Why it was flagged

The script prints fixed performance metrics and a positive conclusion without any historical data retrieval, indicator computation, or strategy simulation.

Skill content
Total trades: 47\nWin rate: 58%\nSharpe ratio: 1.42\nMax drawdown: -8.2%\n...\nConclusion: Strategy OUTPERFORMS buy & hold ✅
Recommendation

Do not use the reported metrics for investment decisions; verify the code performs real calculations before trusting any result.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Users may expect a fuller package setup than the provided artifacts actually contain.

Why it was flagged

The documentation claims dependencies are auto-installed, but the provided install specification says there is no install spec and the script does not use those packages.

Skill content
pandas, numpy, matplotlib (auto-installed) - yfinance for data
Recommendation

Ask the publisher to align the documentation, metadata, and install instructions with the actual implementation.