ClawHub
Back to skill

Security audit

Security Quant Backtest

Security checks across malware telemetry and agentic risk

Overview

This is a single-file educational finance backtesting skill with no hidden execution or credential access, though its sample backtest code has a reliability bug users should not trust for real trading decisions.

Install only as an educational research helper. Do not rely on the included backtesting engine for investment or allocation decisions until its position ledger is fixed and independently tested, and verify any regulatory or market claims against official current sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The backtesting engine records BUY/SELL trades and computes portfolio value, but `_buy` never updates `self.position` and `_sell` iterates over positions that were never populated. This means reported holdings, equity curve, drawdown, and win-rate can be materially wrong, creating misleading research outputs that could drive unsafe trading decisions. In a quantitative trading skill, incorrect backtest state handling is more dangerous because users are likely to rely on the reported metrics for real capital allocation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.