ClawHub
Back to skill

Security audit

Alphagbm Tepper Signal

Security checks across malware telemetry and agentic risk

Overview

This is a transparent market-signal skill with no executable install code or local data access, but its investment wording is aggressive and should be treated cautiously.

Install only if you want a market-timing analysis prompt/API wrapper. Treat any buy or wait output as informational commentary, not investment advice, and verify risk, suitability, diversification, and current market data before making real-money decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes broad natural-language phrases like 'should I buy the panic' and 'are we at a panic bottom', which can easily appear in ordinary market discussions and unintentionally invoke the skill. Because the skill returns prescriptive market-timing output, accidental activation can surface high-risk financial guidance in contexts where the user did not explicitly request this specific strategy.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill provides explicit action-oriented recommendations such as 'scale into SPY/QQQ/DIA' and 'don't miss it' without a clear disclaimer that outputs are informational and not investment advice, and without any risk or suitability warning. In a finance skill, this context makes the issue more dangerous because users may rely on the output for real-money decisions during volatile market conditions, increasing the chance of financial harm or regulatory/compliance problems.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.