ClawHub
Back to skill

Security audit

baostock_tt_skills

Security checks across malware telemetry and agentic risk

Overview

This is a coherent BaoStock market-data and technical-analysis skill, but its trading-style outputs should be treated cautiously because one RSI calculation appears mislabeled.

Install only if you are comfortable using third-party Python packages and sending stock symbols/date ranges to BaoStock. Treat the generated technical-analysis scores and operation suggestions as informational only, especially because the RSI fields appear duplicated rather than independently calculated.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
This is a genuine integrity issue: the script presents RSI(6), RSI(12), and RSI(24) as distinct indicators but reuses the same underlying value for all three. In a financial-analysis skill, mislabeled technical indicators can mislead users into making trading decisions based on false signals, especially because the later scoring logic averages these duplicated values as if they were independent measurements.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger phrase for technical analysis is broad enough that ordinary conversation about a stock could unintentionally activate extra processing and produce advisory-style output the user did not explicitly request. In an agent setting, overly permissive routing can cause unintended tool use, unexpected external data access, and actions outside user intent boundaries.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.