ClawHub
Back to skill

Security audit

RIA — ADV / Form CRS Compliance Checklist

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable RIA compliance checklist with disclosed legal/compliance limitations and no hidden access or persistence.

Installers should treat this as a compliance checklist aid, not legal advice. Use it only for U.S. RIA compliance contexts and verify current SEC or state requirements with a qualified CCO or counsel before filing, publishing marketing materials, or making compliance decisions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation description uses broad compliance-oriented trigger phrases such as amendment season, onboarding, marketing, exams, and generic compliance questions, which can cause the skill to activate for ordinary discussions without a tightly bounded scope. In an agentic system, over-broad invocation can route users into a specialized compliance workflow unexpectedly, increasing the chance of irrelevant guidance, policy overreach, or incorrect autonomous actions based on a misclassified request.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The markdown activation section repeats the same broad triggers in natural language, reinforcing ambiguous invocation boundaries instead of constraining them. Because this skill concerns regulatory compliance, unintended activation is more sensitive than a generic checklist skill: it may cause the agent to present authoritative-seeming compliance gating in contexts where legal/regulatory analysis was not actually requested.

Static analysis

No suspicious patterns detected.