ClawHub
Back to skill

Security audit

Alphagbm Stock Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed stock-analysis helper that calls AlphaGBM APIs and does not show hidden execution, persistence, or unrelated data access.

Install only if you are comfortable using AlphaGBM for stock research, including sending requested tickers and an API key to its service. Treat generated buy/sell labels, target prices, and risk scores as research support, not automatic financial advice or trading authority.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad and map closely to ordinary finance questions, so the skill may activate in general conversation without a strong user intent signal that they want this specific external-analysis workflow. That can cause unexpected tool use, unnecessary API calls, and over-reliance on a third-party stock recommendation path in contexts where the user only wanted informal discussion or educational information.

Content

No source excerpt is available for this finding.