ClawHub
Back to skill

Security audit

A Stock Analysis Conflict

Security checks across malware telemetry and agentic risk

Overview

The stock analysis features look legitimate, but the package identity and portfolio storage path do not match the registry listing, so it may share or alter another skill’s saved portfolio file.

Review before installing. The market-data and portfolio functions appear purpose-aligned, but back up or inspect ~/.clawdbot/skills/a-stock-analysis/portfolio.json first, and avoid using this alongside another a-stock-analysis skill until the name and storage namespace mismatch is clarified.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly documents commands to add, update, and remove holdings, and later notes that portfolio data is stored in `~/.clawdbot/skills/a-stock-analysis/portfolio.json`, but it does not clearly warn at the point of use that these commands persistently modify a local file. This can lead users or agents to make unintended state-changing changes to local data, especially in environments where users may assume skills are read-only unless told otherwise.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.