ClawHub

test

Security checks across malware telemetry and agentic risk

Overview

This is a coherent trading integration, but it deserves user review because it can place live trades and run automated bots without documented confirmations, limits, or credential-scope guidance.

Install only if you trust VibeTrader and understand the API key may enable access to sensitive portfolio data and live trading actions. Start with paper trading, use the least-privileged key available, set brokerage/provider limits, require explicit confirmation for live orders and bot starts, and monitor or revoke access if behavior is unexpected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly promotes live trading and direct purchase actions such as "Buy $500 of TSLA" without providing a prominent warning that commands may trigger real-money transactions or that financial losses may occur. In a chat-driven trading skill, this omission increases the chance of unsafe user behavior, misunderstanding, and accidental execution of financially significant actions.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports switching to live trading mode and performing high-impact actions such as placing orders, closing positions, deleting bots, and starting automated strategies, but it does not present clear warnings or confirmation expectations around real-money execution and irreversible financial effects. In a finance skill, omission of prominent risk disclosure and action safeguards increases the chance of accidental loss, especially when users interact through natural language and may not realize they are authorizing live brokerage activity.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The manifest requires a VIBETRADER_API_KEY but provides no user-facing disclosure about how that credential will be used, transmitted, stored, or scoped. Because this skill connects to a remote MCP server for trading-related actions, the lack of explicit credential-handling guidance increases the risk of users supplying sensitive secrets without understanding where they go or what permissions they enable.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal