ClawHub
Back to skill

Security audit

A Stock Premarket Briefing

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed A-share premarket research/reporting skill, with ordinary web search and setup-command risks rather than evidence of hidden or harmful behavior.

Before installing, confirm you are comfortable with a finance skill that may run local setup commands and perform external web searches. Use explicit prompts such as asking for an A-share premarket report, and treat the output as research support rather than investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises and instructs use of network access and shell execution (`python3 ...`, `pip install`, `brew install`, external search/summarize tooling) but does not declare corresponding permissions. This creates a transparency and policy-bypass risk: an agent or reviewer may underestimate what the skill can do, while the skill can still trigger external connectivity and local command execution in practice.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation examples are broad natural-language phrases like '生成盘前分析报告' and '今天市场主线是什么', which can overlap with ordinary financial conversation and cause the skill to trigger unintentionally. In an agent environment, ambiguous activation can lead to unwanted web searches, synthesized investment-oriented output, or bypass of user intent boundaries when the user was only asking a general market question.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The invocation phrases include broad natural-language requests such as '今天市场有什么热点' and '生成盘前分析报告', which may match ordinary conversation and cause the skill to trigger unintentionally. Because this skill performs external searching and summarization, accidental activation can lead to unnecessary network activity, unexpected tool use, and finance-oriented outputs in contexts where the user did not explicitly request the skill.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.