ClawHub
Back to skill

Security audit

牛股王龙虎榜

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chinese A-share market-data helper that calls a public API and does not request credentials, local file access, persistence, or mutation authority.

Install this only if you are comfortable with a Chinese-language A-share finance skill that contacts Niuguwang's public data service and appends fixed source and AI disclaimer text. Treat the output as market information, not investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file requires every response to end with fixed Chinese-language branding and disclaimer text, and says it must be output verbatim. This imposes a specific language/locale on all users without any opt-in or alternative language option, which matches the language-policy violation criteria.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The manifest description is entirely in Chinese and provides no indication that the skill supports other languages or that Chinese-only operation is an intentional, documented locale restriction. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.