ClawHub
Back to skill

Security audit

trading skill

Security checks for vulnerabilities and agentic risk

Overview

This is a plain-language XAUUSD trading-analysis skill with no code execution, credential access, persistence, or hidden behavior, though users should treat its signals as risky financial analysis rather than instructions to trade automatically.

Install only if you want an Indonesian/WIB-oriented XAUUSD intraday analysis template. Confirm timezone, current market data, and news timing before relying on any signal, and treat BUY/WAIT/NO TRADE output as informational analysis rather than financial advice or authorization to trade.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The mandated output format hardcodes Indonesian language and WIB timezone conventions without checking the user's locale. This can mislead users in other regions about session times, news timing, and trade windows, which is especially risky in a financial trading context where time interpretation directly affects decisions.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The example trigger phrases are very broad natural-language requests such as asking to analyze XAUUSD or check whether it is worth buying. Broad triggers increase the chance the skill is invoked unintentionally in ordinary conversation, which can cause the agent to switch into specialized financial-advice behavior without clear user intent or consent.

Static analysis

No suspicious patterns detected.