ClawHub
Back to skill

Security audit

Security App Wealth Advisor

Security checks across malware telemetry and agentic risk

Overview

This is a single markdown wealth-advisory framework with no executable code, but users should treat its customer-profile examples as sensitive financial data handling.

Install only as an educational or advisor-assist reference. Do not use it to make real financial recommendations without qualified human review, and avoid entering identifiable customer financial data unless your organization has proper consent, retention, and compliance controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill states that it performs no PII processing, but its documented logic clearly analyzes customer financial profile attributes such as risk preference, expected return, preferred term, and available funds to generate personalized recommendations. In a banking context, these attributes are sensitive personal financial data, so the mismatch can mislead reviewers, integrators, or users into underestimating privacy, compliance, and data-handling obligations.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger list includes very broad terms like 'customer service', 'product recommendation', 'bank APP', and common Chinese banking phrases, which can cause accidental or overly frequent invocation outside the intended wealth-advisory workflow. In a regulated banking environment, unintended activation is risky because it may surface advisory content in the wrong context, increasing the chance of unsuitable recommendations, compliance mistakes, or user confusion.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.