ClawHub
Back to skill

Security audit

NexusFIX Development Expert

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only NexusFIX C++ development skill with no executable code, credential use, hidden data access, or persistence.

This skill is reasonable to install for NexusFIX work, but be aware it may activate in broader FIX protocol conversations. Review any generated trading or broker-connectivity code carefully and test it only in a sandbox before using it with live systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad terms such as "FIX protocol" and "FIX connectivity," which can activate the skill for generic financial/protocol queries unrelated to this specific library. Over-broad activation can route users into domain-specific guidance they did not intend, increasing the chance of irrelevant or unsafe code recommendations in trading or connectivity workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.