ClawHub
Back to skill

Security audit

Alphagbm Pnl Simulator

Security checks across malware telemetry and agentic risk

Overview

This skill appears benign: it documents a remote options P&L simulator and does not include executable install code, persistence, or hidden data access.

Before installing, users should understand that option symbols, position legs, prices, IV assumptions, and scenarios entered for simulation may be sent to AlphaGBM unless mock/demo data is used. Avoid submitting sensitive live portfolio details unless that external service is acceptable for your use case.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes generic phrases such as "P&L diagram," "breakeven analysis," and "what happens at expiry," which are broad enough to match loosely related conversations and cause unintended skill invocation. In this skill, accidental invocation can lead to unnecessary transmission of financial position details to a remote API and user confusion about why external analysis was performed.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs use of a remote AlphaGBM API but does not warn users that their trading positions, symbols, and scenario inputs may be transmitted off-platform. Because option positions can reveal sensitive financial strategies and holdings, the lack of disclosure undermines informed consent and increases privacy and data-handling risk.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.