ClawHub
Back to skill

Security audit

fwquant-skills

Security checks for vulnerabilities and agentic risk

Overview

The current skill is a small placeholder for quantitative trading analysis and does not perform trades, connect to exchanges, expose a server, read credentials, or persist anything.

Reasonable to install as a minimal analysis stub. Do not treat it as a complete trading system. If future versions add exchange connectivity, use paper trading first, read-only or tightly scoped API keys where possible, explicit confirmation before orders, and position limits. If a web UI is later implemented, prefer binding to 127.0.0.1 unless remote access is intentional and protected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill advertises live exchange connectivity and trading signal generation, but provides no warning about financial risk, execution consequences, or need for user confirmation before any real-trading action. In an agent context, this can normalize or encourage high-impact financial actions without adequate safeguards, increasing the chance of unintended trades or user harm.

Static analysis

No suspicious patterns detected.