ClawHub
Back to skill

Security audit

wheel-strategy-copilot

Security checks across malware telemetry and agentic risk

Overview

The skill does not execute trades, but it gives specific options-trading actions and account-sized contract guidance while claiming it is not personalized advice.

Review this as a high-risk financial guidance skill, not just an educational calculator. It should not be relied on for real options trades without independent verification, suitability review, and broker-side checks; do not provide broker credentials, and be cautious with any output that tells you exactly what strike, expiration, or contract count to trade.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill’s disclaimer says it is only educational and not personalized investment advice, but the workflow later gives explicit trade actions, ranked strike recommendations, and account-specific contract sizing. In a finance context, this contradiction is dangerous because users may rely on the output as regulated advice while the publisher attempts to disclaim responsibility, increasing legal, suitability, and consumer-harm risk.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The section claiming the skill does not provide personalized buy/sell/hold recommendations is directly undermined by earlier content that instructs users to sell particular option strikes, rank scenarios, and size positions based on account value. This mismatch can mislead users and downstream platforms about the true function of the skill, making harmful financial guidance appear safer or more compliant than it is.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.