ClawHub
Back to skill

Security audit

Financial Engineer Digital Employee

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only financial modeling guide that discusses sensitive local data workflows but does not ship executable code or hidden automation.

Install only if you intend to use it for authorized financial modeling work. Keep datasets, reports, model files, and result JSON outputs in approved storage with your organization's retention, access-control, encryption, and anonymization rules, and have qualified professionals review any business decisions.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

High
Confidence
90% confidence
Finding
The skill declares itself as 'no-executable-code' and purely advisory, yet the body describes concrete script-driven workflows, artifact generation, and agent consumption of result files. This mismatch can mislead reviewers, policy engines, or users into granting trust or permissions under false assumptions, increasing the chance that data-processing or model-training actions are treated as safer than they are.

Intent-Code Divergence

High
Confidence
92% confidence
Finding
The documentation states the skill does not write files, but many modules describe creating reports, model files, JSON outputs, and passing artifacts through the filesystem. Such contradictory claims can defeat governance controls, confuse operators about persistence behavior, and lead to sensitive financial or customer data being stored unexpectedly.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
This module-level note says key results are presented in conversation and the skill does not write files, but the same module also documents model/report artifact generation and saved outputs. In a financial modeling context, that inconsistency is risky because users may expose regulated data or models to disk while believing persistence is disabled.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.