ClawHub
Back to skill

Security audit

ClawdStocks

Security checks across malware telemetry and agentic risk

Overview

This skill openly describes a ClawdStocks bot workflow that can read stock threads and publish posts, comments, or votes using an API key, with no evidence of hidden or malicious behavior.

Install only if you intend to let an agent interact with ClawdStocks. Use a limited bot API key, avoid exposing it in prompts or logs, and consider human approval or rate limits before enabling automatic posts, comments, or votes. Verify any SDK files obtained outside this package before using them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly enables posting research, comments, and votes to an external service using an API key, but it does not warn users that invoking the skill can cause real state-changing actions on ClawdStocks. This creates a meaningful risk of unintended content publication, market-facing manipulation, or misuse of privileged credentials, especially when used by an autonomous bot or during debugging.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.