ClawHub

China Stock Analysis.Bak2

Security checks across malware telemetry and agentic risk

Overview

This is a simple stock-analysis prompt skill with no executable code or hidden access, but users should treat its buy/hold/sell guidance as risky financial commentary, not professional advice.

Install only if you want an agent to research public stock information and draft Chinese-style stock commentary. Do not rely on its buy, hold, or sell suggestions as professional financial advice, and verify market data and risk warnings independently before making investment decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is broad enough to activate on many general stock-analysis requests without clearly limiting when this skill should be chosen. In a multi-skill agent, ambiguous invocation boundaries can cause unintended routing, leading the agent to apply this skill's web-search and recommendation behavior in contexts where the user did not specifically request Chinese stock analysis or where a safer, more appropriate skill should handle the request.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The output template hard-codes Chinese-language section headers and response structure, which can override the user's language preference and reduce transparency about what the model is doing. In agent settings, forcing a specific language without user opt-in can create consent and usability issues, and may be used to obscure risky financial recommendations from users who are not fluent in Chinese.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
Mandating a disclaimer only in Chinese can prevent some users from understanding an important risk warning, especially if the surrounding conversation is in another language. While not directly enabling code execution or data exfiltration, it weakens informed consent around high-risk financial advice by making the safety notice less accessible.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal