ClawHub
Back to skill

Security audit

dcf-valuation

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent DCF valuation helper that runs local calculations and may save reports, with no evidence of hidden or malicious behavior.

Expect the skill to create local Markdown valuation reports that may contain financial assumptions and company research. Avoid using or configuring Feishu sync unless you are comfortable sending that content to that workspace, and treat the output as analysis rather than investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README advertises automatic local file generation and optional Feishu cloud document sync, but does not clearly warn users that analysis content may be persisted to disk or transmitted to a third-party service. In a finance-analysis skill, outputs may contain sensitive company research, user prompts, or proprietary notes, so silent persistence or sync can create confidentiality and compliance risks.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.