ClawHub
Back to skill

Security audit

Gold Trading Skill

Security checks across malware telemetry and agentic risk

Overview

This is not malware, but it gives speculative gold-trading guidance and pushes a paid automation product without adequate risk disclosure.

Review carefully before installing. Treat this as promotional financial content, not vetted investment advice. Independently verify Gold-Oracle, the checkout site, any broker or prop firm, and all performance or safety claims; use demo or paper trading before risking real money.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger condition 'when the user asks for help trading gold' is broad and can cause the skill to activate in loosely related contexts, increasing the chance of unsolicited financial guidance or upsell behavior. In a high-risk domain like trading, unintended invocation is more dangerous because it may steer users toward speculative actions or purchases without clear intent or suitability checks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill gives concrete trading instructions and actively promotes purchasing a third-party subscription while omitting a clear financial risk disclosure, suitability warning, or statement that losses can occur. This is especially risky because the content presents the system as 'proven' and 'focused on safety,' which can create misplaced trust and nudge users into speculative financial decisions or commercial transactions.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.