ClawHub
Back to skill

Security audit

fintech-specialist

Security checks across malware telemetry and agentic risk

Overview

This is a fintech guidance skill with Markdown examples only; it has some risky example-code caveats but no hidden execution or credential-stealing behavior.

Install only if you want fintech reference guidance. Treat the payment and DeFi snippets as educational starting points, not audited production code; have payment, security, smart-contract, and compliance specialists review any adapted implementation before it handles real funds, card data, credentials, or customer records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The code claims to produce immutable audit records, but it also emits the same audit events to the console, which is not append-only, tamper-evident, or a controlled audit sink. In a fintech/payment context, this can undermine evidentiary integrity, leak sensitive operational data into transient log pipelines, and create false assurance about compliance-grade auditability.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The code presents local encryption plus Redis storage of raw card details as 'tokenization for PCI compliance', but this still places the application inside the cardholder-data handling boundary. If compromised, attackers could recover PAN/CVC data from the app path or token store, and the misleading comment may cause teams to under-scope PCI obligations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/examples.md:434