ClawHub
Back to skill

Security audit

aggressive_growth_strategy

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed stock-analysis toolkit that fetches market data and produces reports, without hidden persistence, credential use, or trading execution.

Before installing, understand that this skill may run local Python scripts, install market-data packages if dependencies are missing, and make network requests to financial-data providers. It does not appear to trade, access brokerage accounts, or store credentials, but its stock ratings and buy/sell plans should be reviewed as informational analysis only.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to run shell commands and Python scripts, install packages, and use curl against external APIs, yet no permissions are declared. That creates a capability/consent mismatch: an orchestrator or reviewer may treat the skill as low-risk while it can actually execute code and make networked requests.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough that ordinary requests like 'analyze this stock' or 'should I add to my position' may auto-load the skill in many benign market conversations. Because this skill can drive shell-backed tooling and produce actionable trading outputs, over-broad activation increases the chance of unintended execution and inappropriate advice generation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill provides concrete entry sizing, sell ladders, and seasonal position guidance without a prominent upfront financial-risk warning or suitability boundary. Users may interpret these outputs as personalized investment advice, increasing legal/compliance risk and potential user harm from losses.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.