ClawHub
Back to skill

Security audit

Over Computer

Security checks across malware telemetry and agentic risk

Overview

This skill is transparent about being a prediction-market trading integration, but it gives an agent wallet-linked trading authority without clear per-trade confirmation requirements.

Review before installing. Use this only if you are comfortable giving an agent access to a wallet-linked trading API. Configure strict limits on over.computer, require explicit confirmation for every order, review the active remote prompt before trading, and revoke or rotate the API key when you stop using it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger language is broad enough to activate on general discussion about markets, trading, or predictions rather than a clear request to use this skill. In a skill that can approve funds and place real-money trades, accidental invocation materially increases the risk of unauthorized or unintended financial actions.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill invites use for approving funds and placing orders without an explicit warning that these actions may involve real money and can be irreversible. In the context of prediction-market trading, omitting a warning and confirmation requirement makes mistaken or impulsive execution significantly more dangerous.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal