ClawHub
Back to skill

Security audit

News Alert | 新闻监控

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only portfolio news monitoring skill with disclosed alerts and no executable code or credential requests.

Install this only if you want the agent to use your holdings or watchlist as context for news monitoring. Configure which companies to track, what counts as important news, and when proactive alerts or summaries are acceptable; avoid sharing brokerage credentials or unnecessary account details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad natural-language requests like asking for recent news or new updates, which can easily appear in ordinary conversation and cause unintended activation. In a financial-monitoring skill, accidental invocation can lead to irrelevant alerts, context leakage about holdings, or the agent taking action when the user did not explicitly intend to use this skill.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The quick commands are extremely short and ambiguous, especially terms like '新闻' and '今日重点', which are common in normal chat and not specific to this skill. This increases the chance of accidental routing to the skill, producing unintended financial summaries or exposing portfolio-related context in situations where the user meant a general news request.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal