ClawHub
Back to skill

Security audit

Cup and Handle Pattern Detector

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently analyzes stock price data for cup-and-handle patterns and creates local charts or reports when the user runs it.

Install if you are comfortable running local Python stock-analysis scripts. Provide TUSHARE_TOKEN only when you want live Tushare data, and point batch mode only at SQLite databases intended for this analysis because it scans every table and writes charts plus a report.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill documentation indicates it reads environment variables (for `TUSHARE_TOKEN`) and writes files (chart output to a temporary directory), but no permissions are declared. Undeclared capabilities weaken transparency and policy enforcement, making it easier for a host agent or user to invoke behavior that accesses secrets or writes artifacts without explicit review.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The declared purpose focuses on cup-and-handle detection and visualization, but the documented behavior also includes remote API access, SQLite-wide batch scanning, and Markdown report generation. This mismatch is dangerous because users and orchestration systems may authorize the skill for narrow analysis while it performs broader network, database, and file-generation actions than expected.

Static analysis

No suspicious patterns detected.