ClawHub
Back to skill

Security audit

celebrity-hot-money-tag

Security checks across malware telemetry and agentic risk

Overview

This is a text-only stock-trading analysis skill with no code or account access, but its investment recommendations are unsupported and should be treated cautiously.

Install only if you want a reference-style prompt for discussing Chinese dragon-tiger-list trader patterns. Treat the win rates and 'recommended to follow' labels as unverified general information, not personalized investment advice, and independently verify market data and risks before making any trade.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to provide follow-investment advice, win rates, and recommendations, but it contains no financial-risk disclaimer, suitability warning, or statement that historical performance does not guarantee future results. In this context, users may treat the output as actionable investment guidance, increasing the risk of financial harm and misleading reliance.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The repeated '推荐跟投' labels across trader profiles create a strong endorsement signal without any caution about volatility, survivorship bias, manipulation risk, or the limits of historical win-rate statistics. Because the entire skill centers on copying well-known traders from market activity, the surrounding context makes the omission more dangerous by encouraging direct imitation of speculative trading behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.