ClawHub
Back to skill

Security audit

Market Signals

Security checks across malware telemetry and agentic risk

Overview

This is a local CSV technical-analysis tool with disclosed financial signal output and no evidence of network access, persistence, credential use, or hidden behavior.

Install only if you want a local tool that analyzes CSV price data and produces technical trading signals. Do not treat its buy/watch/wait/avoid labels as financial advice, and use --output carefully because it writes to the path you provide.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises itself as 'pure local' and 'read-only CSV', but its documented usage includes writing output files via --output and the metadata does not declare permissions for file read/write. This creates a trust and policy gap: a host may expose file access implicitly without users understanding the scope, increasing risk of unintended file access or overwrite.

Vague Triggers

Medium
Confidence
80% confidence
Finding
Broad trigger keywords such as '技术分析', 'RSI', '均线', and 'MACD' can cause the skill to activate in loosely related conversations without clear user intent. Overbroad activation increases the chance of unsolicited financial guidance or unintended processing of local files in contexts where the user did not explicitly request this skill.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill gives buy/attention/wait/avoid style recommendations and composite scoring without any financial-risk disclaimer or statement that outputs are informational rather than investment advice. In financial contexts, users may over-rely on these recommendations, potentially leading to harmful decisions and elevated compliance or safety risk.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.