ClawHub
Back to skill

Security audit

Trading Universe

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local trading-analysis dashboard with market-data calls, local trade logs, alerts, and optional reasoning-provider integrations, with no evidence of hidden trade execution or deceptive exfiltration.

Before installing, be comfortable with a financial-analysis tool that writes a private local data directory, polls public market/news sources, and can send ticket or fundamentals data to a reasoning provider only after you configure one. Do not save an API key unless you want it stored locally, and only run the auxiliary watcher or alert-sender scripts if you want background alerts or Telegram/OpenClaw notification delivery.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script sends queued alert contents to an external Telegram channel via the OpenClaw messaging tool, but the skill description emphasizes local trading scans and tracking and does not clearly disclose outbound notifications. This creates an unexpected data egress path: alert contents, symbols, plans, or other potentially sensitive trading information can leave the local environment without explicit user awareness or consent.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The comments and documented contract claim the dashboard only writes request files for an external agent to fulfill, but later code directly invokes external reasoning providers and local CLIs to process those requests. This is dangerous because users may trust the tool with local-only assumptions while it can actually transmit market data and user-entered prompts/API keys to third parties, materially changing the security and privacy boundary.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
This is the same underlying trust-boundary issue: the file states 'the dashboard has no AI' and implies only file-based handoff, while the implementation contains direct LLM fulfillment paths. Security-relevant misrepresentation is risky because it can cause users to enter secrets or use the feature in environments where outbound model access is forbidden or unexpected.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The watcher continuously polls Yahoo Finance and persists/queues outbound alerts in the background, which expands behavior beyond a purely local deterministic analysis tool into ongoing networked monitoring. Even though the code is not overtly malicious, persistent background execution and external data/alert flows increase attack surface, create privacy/operational risk, and can surprise users if this capability was not clearly disclosed or consented to.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The playbook instructs the agent to overwrite files under `~/.trading-universe/` as part of a fallback workflow, but it does not require explicit user confirmation or prominently warn that local files will be modified. Even though the target paths are constrained, silent overwrite behavior can destroy prior data, replace pending review state, or be abused by a prompt-injected conversation to cause unintended local state changes.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Messages are transmitted externally to Telegram without any user-facing warning, consent flow, or disclosure of the exact content being exfiltrated. In a trading-analysis skill, alerts may contain proprietary setups, account-related context, or operational signals; silent transmission increases privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script reads the user's local trade log from disk and incorporates it into output as 'lessons' without any user-facing disclosure or consent mechanism in the executing code. In an agent skill context, silent access to behavior/history data is privacy-sensitive because the model can surface or act on personal trading history the user may not expect to be consumed for each run.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The script silently reads a local fundamentals.json file from the user's home data directory and uses it to influence scoring/output. Although lower sensitivity than trade history, it still accesses local user data without visible disclosure, which can surprise users and leak locally stored preferences or research state through downstream model responses.

External Transmission

Medium
Category
Data Exfiltration
Content
],
  },
  openai: {
    label: "OpenAI", base: "https://api.openai.com/v1",
    models: ["gpt-5.5", "gpt-5.5-pro", "gpt-5.4", "gpt-5.4-mini", "gpt-5.2"],
  },
  openrouter: {
Confidence
92% confidence
Finding
https://api.openai.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/dashboard.mjs:102

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/dashboard.mjs:27