ClawHub
Back to skill

Security audit

Alphagbm Take Profit

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent but should be reviewed because it gives concrete stock sell-order guidance without explicit confirmation, suitability checks, or financial-risk framing.

Review this before installing if you use agents for investing workflows. It does not contain executable code or broker access, but it can produce specific sell-order instructions and uses an external AlphaGBM API with credit usage and global caching for first-time ticker analysis.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list is broad enough to match ordinary investing conversations such as 'when to sell NVDA' or 'exit strategy for my stock', which can cause the skill to activate outside a clearly intentional request for this specific tool. In a financial domain, accidental invocation is more dangerous because the skill may inject prescriptive trading guidance into generic discussion without the user explicitly opting into automated sell-strategy analysis.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the caller to generate concrete GTC limit-sell orders at fixed multiples of entry, which turns analysis output into actionable trading instructions without requiring user confirmation, suitability checks, or risk disclosures. In a financial context, this materially raises the chance of harmful automation or overconfident execution based on a generalized model and cached historical results.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.