ClawHub
Back to skill

Security audit

Position Risk Manager

Security checks across malware telemetry and agentic risk

Overview

This skill gives disclosed stock position risk-management guidance and includes a local calculator, with no evidence of hidden execution, credential use, brokerage access, persistence, or data exfiltration.

Install only if you want Chinese-language help thinking through existing stock positions. Verify prices and assumptions yourself, avoid treating the output as licensed financial advice, and be cautious before installing optional dependencies such as AKShare or pandas.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill description is broad enough to activate on many generic stock-holding or trading questions, which can cause the agent to provide prescriptive portfolio-management advice without clear gating. In a financial context, over-triggering is risky because users may receive actionable trading guidance in situations where the skill should instead ask clarifying questions, defer, or avoid regulated advice boundaries.

Vague Triggers

Low
Confidence
79% confidence
Finding
The example prompts show likely activations but do not define boundaries or exclusions, so the skill may match loosely related financial queries and respond too aggressively with trading instructions. This is less severe than the metadata issue, but still increases the chance of accidental invocation and unsuitable advice in ambiguous contexts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.