ClawHub
Back to skill

Security audit

Alphagbm Tepper Signal

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it should go to Review because it gives direct market-timing buy guidance from broad investing prompts without clear financial-risk guardrails.

Install only if you understand this is a market-signal aid, not personalized financial advice. Treat any buy or bottom-call language as informational, verify the data and assumptions independently, and avoid allowing the skill to answer broad investing questions without an explicit confirmation step.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list contains broad, natural-language investing phrases such as 'should I buy the panic' and 'are we at a panic bottom' that could be matched during general market discussion, causing the skill to activate unexpectedly. In this context, accidental invocation is riskier because the skill returns concrete market-timing and buy recommendations, which may steer users into financial decisions without deliberate intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill provides direct investment-style prescriptions like 'Historic-level buying moment — scale into SPY/QQQ/DIA' and 'don't miss it' without any financial-risk warning, suitability caveat, or statement that the output is informational rather than personalized advice. Because the skill is framed as a historically validated panic-bottom detector, users may over-trust the output and act on concentrated or mistimed trades during volatile conditions.

Static analysis

No suspicious patterns detected.