ClawHub
Back to skill

Security audit

Alphagbm Tepper Signal

Security checks for vulnerabilities and agentic risk

Overview

This is a single markdown-only finance signal skill with no code execution, persistence, credential access, or hidden behavior, but users should treat its trading language cautiously.

Install only if you want an agent to surface a high-conviction market panic signal. Treat its output as informational research, not personalized financial advice, and do not let it place trades or make portfolio decisions without separate review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad natural-language phrases like 'should I buy the panic' and 'are we at a panic bottom', which are likely to match ordinary investing conversations beyond a clearly intentional invocation of this specific skill. In a finance context, over-broad activation is risky because it can inject high-conviction buy advice into ambiguous user requests and increase the chance of unintended financial guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill provides direct, actionable trading prescriptions such as 'scale into SPY/QQQ/DIA' and frames the result as a 'historic-level buying moment' without any visible warning that the output is informational, probabilistic, and not financial advice. In this context, the absence of risk disclosures makes the skill more dangerous because it presents speculative market timing as an authoritative yes/no decision, which may cause users to act without understanding losses, uncertainty, or suitability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.