ClawHub
Back to skill

Security audit

Wealth

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only wealth-planning skill with no code or account access, but its financial guidance should be treated as educational rather than professional advice.

Install only if you want general financial-planning help. Do not treat outputs as licensed financial, tax, legal, insurance, or investment advice; verify current limits and laws, avoid sharing account numbers or identifiers, and consult qualified professionals before major decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The examples present specific financial, tax, and investment guidance in a highly actionable way without any disclaimer that outputs are general educational information rather than personalized professional advice. In a wealth-management skill, users may reasonably rely on these examples as tailored recommendations, which can lead to unsuitable investing, retirement, or tax decisions based on incomplete context.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad generic finance terms such as "wealth," "investing," "retirement," and "financial advisor," which can cause the skill to activate in conversations where the user did not intend to invoke this specific capability. In a financial domain, unintended invocation is meaningful because the skill may steer users into financial-planning workflows or advice contexts at inappropriate times, increasing the risk of irrelevant, overconfident, or context-misaligned guidance.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill is defined with a very broad wealth-management scope and no clear activation boundaries, which increases the chance an agent will invoke it in situations requiring licensed, jurisdiction-specific, or highly personalized financial advice. In this context, overbroad routing is dangerous because the skill covers investing, taxes, insurance, estate planning, and retirement decisions that can materially affect a user's finances if applied without qualification or context checks.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill provides extensive financial guidance across investing, tax strategy, insurance, retirement, and estate topics without a clear warning that outputs are informational and may be incomplete, outdated, or inappropriate for a user's specific circumstances. That omission is particularly risky here because users may reasonably rely on the skill for decisions with long-term monetary, tax, and legal consequences.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.