ClawHub
Back to skill

Security audit

Global Stock Analysis

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed market-data helper that requires an Alpha Vantage API key and does not contain executable code of its own.

Before installing, confirm you are comfortable installing the third-party marketdata-cli package and giving it an Alpha Vantage API key. Store the key securely, avoid committing any .env file, and review commands before running them, especially if using outputs for financial decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest description scopes the skill as a global stock analysis tool focused on stock markets and related technical/fundamental analysis. However, the same file documents additional capabilities for forex, cryptocurrencies, and options chains, which materially extend beyond stock analysis as described.

Missing User Warnings

Low
Confidence
95% confidence
Finding
For markdown files, this rule applies when the skill description omits warnings about behaviors affecting privacy or sensitive data. The file explicitly instructs users to store `ALPHAVANTAGE_API_KEY` in the environment or a `.env` file, but does not warn users to keep the key private, avoid committing `.env` files, or otherwise protect the credential.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.