ClawHub

Profitabul

Security checks across malware telemetry and agentic risk

Overview

This trading skill is coherent, but it can enable real futures trades through an agent without clearly documenting trade confirmations, financial risk, or credential limits.

Review before installing. Use paper trading or read-only access unless you intentionally want live execution, keep the API key private and least-privileged, and require explicit human approval before any live order, position change, or cancellation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly advertises live trade execution through a broker but does not present a prominent warning that these actions may place real-money orders and can cause immediate financial loss. In an agent context, users may assume tool calls are informational unless clearly warned, so omission of a strong safety notice materially increases the risk of unintended irreversible actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The recommended workflow culminates in opening a live trade if enabled, but it does so as a normal step without any adjacent caution, human-approval requirement, or risk disclosure. That framing can normalize autonomous execution by an agent and increase the chance of accidental or insufficiently reviewed real-money trading decisions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal