ClawHub
Back to skill

Security audit

HyperGrok Desk Post Trade Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed trading-desk journaling and post-trade review procedure, with expected access to trade records and workspace files.

Install only if you want an agent to read trading records and maintain post-trade journal/review files. Use explicit trade IDs or review requests to avoid accidental activation from vague phrases, and review generated status changes or DMs before relying on them operationally.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description says the skill should be used "after any send, when a trade closes, on the weekly routine, or when the user asks 'how did that go'", which creates a broad natural-language trigger surface. Ambiguous phrases like "how did that go" can match ordinary conversation and cause the skill to activate in contexts the user did not explicitly intend, potentially leading to unintended file reads/writes, journaling, or status changes in a trading workflow.

Static analysis

No suspicious patterns detected.