ClawHub
Back to skill

Security audit

Unified Asset Advisor

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed financial-analysis skill that gathers public market data and generates reports, with notable investment-risk cautions but no evidence of hidden, destructive, or credential-seeking behavior.

Install only if you want an agent to fetch public market data and produce China-focused asset-allocation reports. Review outputs carefully, especially futures and options sections, because the skill can generate actionable investment ideas but does not verify suitability, risk tolerance, or regulatory compliance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are broad, generic financial terms that are likely to appear in ordinary conversation, causing the skill to activate unexpectedly. Because this skill can drive investment recommendations, file generation, external data access, and multi-step analysis, over-triggering increases the chance of unrequested actions and inappropriate advice in contexts where the user did not explicitly ask for this workflow.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill description does not clearly warn users that it may generate investment recommendations and save multiple files to the working directory. This reduces informed consent and can lead users to trigger regulated or high-stakes financial guidance, plus persistent artifact creation, without understanding the consequences or data-handling behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
This file gives concrete futures and options trading directions, including bullish/bearish strategy selection, contract mappings, and parameter templates, but does not include clear risk disclosures, suitability constraints, or warnings about leverage, unlimited-loss structures, and rapid capital loss. In the context of an asset-allocation skill that may generate actionable investment recommendations, this omission materially increases the chance that users treat the output as safe operational guidance and suffer significant financial harm.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.