ClawHub
Back to skill

Security audit

Daily Stock Analysis

Security checks across malware telemetry and agentic risk

Overview

This skill appears safe: it creates local stock-analysis reports, reads limited prior reports for accuracy tracking, and does not show hidden data access or malicious behavior.

Install only if you are comfortable with the skill saving stock reports in your chosen working directory and reusing those reports in later runs. Use a dedicated project folder rather than a sensitive home or business-data directory, review any proposed legacy-file migration before approving it, and treat the financial output as research rather than investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs the agent to read files under `working_directory` and to read prior report history, but it declares no permissions. This creates a capability/permission mismatch that can bypass user expectations and platform policy checks, increasing the chance of unintended data access if the working directory contains sensitive files or symlinks.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill advertises stock-analysis functionality but its defined behavior prominently includes filesystem planning and migration operations, while the actual analysis/report generation logic is delegated or unspecified. That mismatch is dangerous because users and reviewers may approve it for benign analysis use while it performs broader file-management actions, including reorganizing files via migration, which can be abused for unintended file discovery or modification within the allowed workspace.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.