ClawHub
Back to skill

Security audit

Crypto Snapshot Pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly disclosed paid crypto-signal helper, but users should treat its outputs as high-risk financial information rather than financial advice.

Install only if you intentionally want paid crypto trading signals. Confirm the token symbol and payment before use, do not treat results as financial advice, and understand that crypto trades can lose money even when entry, target, and stop levels are provided.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger condition is broad enough that the skill could activate on loosely related requests and begin steering users into paid, actionable trading guidance without clear boundaries or suitability checks. In a financial-trading context, overbroad invocation increases the chance of unsolicited or insufficiently contextualized investment advice, which can cause monetary harm or misuse of agent behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill offers concrete LONG/SHORT/HOLD signals, entry prices, targets, and stop-loss levels, but the risk warning appears only inside an example response rather than upfront in the skill description and usage guidance. That makes the skill more likely to present high-risk financial recommendations as routine assistance, which is especially dangerous because the content is actionable and monetized.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.