ClawHub
Back to skill

Security audit

Molt Trader Skill

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed SDK for a simulated trading service, with user-run examples that can change only the user’s Molt Trader simulator account state.

Install this only if you want scripts or agents to act in your Molt Trader simulator account. Use a dedicated, revocable API key, verify the configured base URL before running examples, and monitor or stop automated strategies because they can keep changing simulated positions while active.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The strategy automatically submits position-closing trades on a timer without any interactive confirmation, dry-run safeguard, or strong startup warning. In a live trading context, running example code against a real account can trigger unintended liquidation of positions, causing financial loss or operational disruption if the user misconfigures credentials or does not realize the example is active trading logic.

Known Vulnerable Dependency: @trpc/server==11.0.0 — 2 advisory(ies): CVE-2025-68130 (tRPC has possible prototype pollution in `experimental_nextAppDirCaller`); CVE-2025-43855 (tRPC 11 WebSocket DoS Vulnerability)

High
Category
Supply Chain
Confidence
98% confidence
Finding
@trpc/server==11.0.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.