ClawHub
Back to skill

Security audit

jin-duo-duo-strategy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed stock technical-analysis helper that runs local indicator calculations, with no evidence of hidden data collection, credential use, network calls, or trading execution.

Use this as an educational technical-analysis tool, not as financial advice or an automated trading system. Install dependencies from a trusted package index, consider pinning pandas and numpy, and avoid enabling memory unless you are comfortable with your stock-analysis history being retained.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger condition is broad enough to activate on ordinary discussion of stock timing or strategy analysis, which can cause the skill to engage when the user did not intend to invoke a trading-analysis workflow. In a financial context, accidental activation increases the chance of the agent producing authoritative-seeming market guidance from incomplete context, leading to inappropriate recommendations or overreach.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
Confidence
97% confidence
Finding
The dependency is only lower-bounded (pandas>=2.0.0), which allows future unreviewed versions to be installed and can also lead to non-reproducible environments. In a trading-analysis skill, unexpected dependency changes can introduce security regressions or break analytical behavior in ways that affect downstream decisions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas>=2.0.0
numpy>=1.24.0
Confidence
97% confidence
Finding
The dependency is specified as numpy>=1.24.0, so package resolution may pull newer unvetted releases, reducing build reproducibility and increasing supply-chain risk. For software used in financial analysis, silent dependency drift can change behavior or expose the environment to newly introduced vulnerable versions.

Static analysis

No suspicious patterns detected.