ClawHub
Back to skill

Security audit

chundengtai-v3

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent A-share trading-analysis guide, but it gives firm buy/sell and position guidance without clear financial risk warnings and promotes private signal access.

Review carefully before installing. This skill does not appear to execute trades or access accounts, but it can produce confident trading guidance; treat outputs as informational only, verify data independently, and do not rely on the private signal promotion or position rules as personalized financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill gives concrete trading recommendations, timing rules, stop-loss/take-profit logic, and invites users to obtain additional signals via private contact, yet it includes no financial risk disclosure or warning that losses can occur. In a financial-decision skill, this omission can cause users to over-trust the output as authoritative investment advice, increasing the likelihood of harmful or unsuitable trading actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.