ClawHub
Back to skill

Security audit

A Stock Quant Diag

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent A-share stock analysis guide that uses public market data, but users should treat its investment recommendations as general research, not personalized financial advice.

Install only if you want an agent to generate A-share research using public market data. Review any web fallback sources, verify figures independently, and do not treat the generated buy/sell or position-size outputs as personalized financial advice or authorization to trade.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest advertises akshare/baostock as the data sources, but the documentation explicitly allows fallback to web_fetch or other unspecified sources. That creates a trust-boundary expansion: the agent may consume unvetted external content, increasing risks of prompt injection, data integrity issues, and unexpected behavior when a web source returns adversarial or misleading content.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill provides concrete buy/sell ratings, position sizing, stop-loss guidance, and portfolio actions without a clear warning that outputs are general analysis rather than personalized financial advice. In this context, the danger is not system compromise but user harm: recipients may rely on prescriptive recommendations without suitability checks, risk disclosures, or regulatory framing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.