ClawHub
Back to skill

Security audit

Options Strategies Lite

Security checks for vulnerabilities and agentic risk

Overview

This is a plain Markdown educational options-strategy guide with no code, persistence, credential use, trading execution, or hidden behavior.

Before installing, treat this as educational financial content only. It may help compare options strategies, but it is not personalized investment advice and does not include position sizing, Greeks, exit criteria, or risk-management detail needed before trading.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill is a selector and guide covering covered calls, cash-secured puts, vertical spreads, iron condors, and LEAPS. However, the skill content also recommends and explains additional strategies such as long calls, long puts, protective puts, long straddles, long strangles, and references iron butterflies as part of the selector, which exceeds the stated five-strategy scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description says 'Tell me your market outlook and I'll point you to the right strategy,' which describes activation in very general natural language rather than a constrained trigger or narrow invocation context. Because similar phrasing could occur in ordinary financial chats, the skill's trigger scope is not clearly bounded.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The 'What This Skill Does' section states the Lite version provides a plain-English breakdown of 5 core strategies and lists excluded advanced/full-version features. Yet the selector later recommends long calls, long puts, protective puts, long straddles, long strangles, and an iron butterfly marked as full version, contradicting the stated Lite-only scope and exclusions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The section 'Tell me your outlook and I'll point you to the right strategy' implies the skill should activate from a very broad class of user statements, but does not specify what counts as an invocation versus ordinary discussion. There are no exclusion conditions or negative examples to reduce unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.