ClawHub
Back to skill

Security audit

Alphagbm Options Strategy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documented options-strategy helper that uses an external AlphaGBM API but does not contain code for trading, persistence, or hidden local access.

Before installing, understand that ticker symbols, market views, risk preferences, and related strategy parameters may be sent to AlphaGBM when live API calls are used. Avoid entering highly sensitive portfolio or trading-intent details unless you are comfortable with that external service, and treat the output as analysis rather than automatic trading authority.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill clearly depends on an external AlphaGBM service and may send user-supplied tickers, market views, and trading preferences to that remote API, but it does not prominently warn users of this data transmission. In a financial-analysis context, those inputs can reveal trading intent or sensitive investment behavior, so the omission creates a meaningful privacy and transparency risk.

Static analysis

No suspicious patterns detected.