ClawHub
Back to skill

Security audit

HKEX L&I Daily Factor Monitor

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed HKEX data monitor with an optional, user-confirmed schedule and no evidence of hidden data access, credential use, or exfiltration.

Before installing the schedule, confirm you want a weekday 18:30 Asia/Hong_Kong OpenClaw cron job with exec access to run this monitor. Review the config path and tmp_dir if you need tighter local storage control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill includes a procedure to create and manage OpenClaw cron jobs, which modifies persistent scheduler state beyond merely fetching and formatting HKEX data. If executed in an automated or over-privileged context, this can create unauthorized persistence and recurring execution without a narrowly separated admin workflow.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:144