ClawHub
Back to skill

Security audit

九维雷达V3.0终极选股系统

Security checks across malware telemetry and agentic risk

Overview

No hidden code or credential theft was found, but the skill gives highly specific trading guidance with confident return claims.

Install only if you want an aggressive stock-screening framework, not neutral financial advice. Treat outputs as educational analysis, verify all market data independently, consider your own risk tolerance, and do not rely on the skill alone for real trading decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README provides concrete stock picks, target prices, position sizing, and explicit 'doubling probability' claims in a way that can strongly influence users toward high-risk financial decisions. Although a risk disclaimer appears later, it is not prominent or upfront enough to counterbalance the prescriptive nature and apparent certainty of the recommendations.

Missing User Warnings

High
Confidence
98% confidence
Finding
The file gives highly specific, action-oriented trading instructions, including staged averaging down, concentrated position sizing, leverage-like risk tolerance, and aggressive return targeting, without any warning that the content is not financial advice or may cause substantial losses. In this skill context, the danger is elevated because the entire skill is designed to drive real stock selection and trading decisions, so users may rely on it as authoritative guidance and suffer significant financial harm.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.