ClawHub
Back to skill

Security audit

risk-manager

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent portfolio risk-analysis skill that uses the Finskills API for market data, with privacy considerations around portfolio-related inputs.

Install only if you are comfortable using Finskills for market-data lookups. Use a dedicated Finskills API key if possible, avoid entering portfolio or account-size details you do not want the agent to process, and treat the output as analytical support rather than investment advice.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad enough to match ordinary financial discussion, which can cause the skill to activate in situations where a user did not clearly intend portfolio-risk processing. In this skill’s context, accidental activation is more sensitive because prompts may include holdings, account size, stops, and hedging intent, increasing the chance of unnecessary collection or transmission of personal financial data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README says the skill fetches data for each portfolio holding and uses external API endpoints, but it does not explicitly warn users that their portfolio symbols, position details, or related financial context may be sent to third-party services. In a finance skill, that omission is more dangerous because portfolio composition and trade-sizing information are sensitive and can reveal wealth, strategy, and risk tolerance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill asks for portfolio holdings, position sizing inputs, and related risk-analysis data, then instructs the agent to query a third-party API, but it does not clearly disclose what user financial data may be transmitted externally. In a finance context, portfolio composition and account-sizing details are sensitive, so silent or ambiguous sharing can expose private investment information and create compliance and trust risks.

Static analysis

No suspicious patterns detected.