Security audit

Beta Backtester

Security checks across malware telemetry and agentic risk

Overview

This looks like a mock trading backtester presented as a real professional tool, which could mislead users about investment performance.

Install only if you understand this is not a real backtesting engine. Do not rely on its reported returns, drawdown, Sharpe ratio, or outperformance claim for financial decisions unless the publisher replaces the canned output with transparent data-backed calculations and labels any examples clearly as sample data.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims to be a professional backtesting framework, but the implementation only prints fixed, favorable results and performs no real historical-data analysis. In a trading context, this is dangerous because users may rely on fabricated performance metrics to make financial decisions, creating a substantial risk of deception and monetary loss.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The program presents specific returns, Sharpe ratio, drawdown, and an 'OUTPERFORMS' conclusion as if they were real outputs, without any disclosure that they are static example values. Because the skill is framed as a professional trading backtester, the surrounding context increases the danger: users are more likely to trust and act on these figures as genuine investment analysis.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.