ClawHub
Back to skill

Security audit

Alphagbm Pnl Simulator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed options P&L simulation helper that may use AlphaGBM's remote API, with no executable code, persistence, or hidden local access.

Install this only if you are comfortable sending option-position and scenario details to AlphaGBM's API. Use mock/demo data or avoid entering sensitive portfolio details unless you trust that service and its data handling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are broad enough to match ordinary finance conversations such as generic 'P&L diagram' or 'breakeven analysis' requests, which can cause the skill to activate unexpectedly. In this skill, unexpected activation is more concerning because it can route user portfolio or position details into an external options-simulation workflow and potentially to a remote API.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents an external API endpoint and API key but does not clearly disclose that user-supplied market, position, and scenario data may be transmitted to a third-party service. In a financial context, position data can be sensitive, so silent transmission creates privacy, compliance, and trust risks, especially if users assume analysis is local.

Static analysis

No suspicious patterns detected.