ClawHub
Back to skill

Security audit

Yahoo Finance FOREX

Security checks across malware telemetry and agentic risk

Overview

This skill transparently fetches public Yahoo Finance forex data and produces simple sentiment labels, but its trading recommendations should not be treated as financial advice.

Install only if you are comfortable with a Python script installing yfinance and making network requests for public Yahoo Finance data. Treat BUY/SELL/HOLD outputs as informational sentiment labels, not personalized investment advice, and verify independently before making any forex trades.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
This documentation gives explicit BUY/HOLD/SELL recommendations and action-oriented trading guidance, which materially expands the skill from market data and sentiment analysis into investment advice. In a finance context, users may rely on these recommendations for real-money decisions, increasing the chance of financial loss and creating a harmful mismatch between the declared skill purpose and actual behavior.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The guide extends beyond sentiment interpretation into trade strategy, entry timing, position sizing, and stop-loss guidance. That turns an informational analysis skill into a decision-support tool for trading, which is more dangerous because users may treat the documentation as authoritative operational advice despite the manifest not declaring that capability.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This reference file includes actionable trading guidance such as best trading times, correlation-based risk management, pip values, risk factors, and best practices, but it does not include any warning that forex trading involves substantial risk and potential losses. In a skill that fetches real-time market data and analyzes sentiment, omission of a financial-risk disclaimer can cause users to over-trust the output as decision support, increasing the chance of harmful financial decisions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The document presents trading recommendations without a clear warning that they are not financial advice and may cause financial loss. In a FOREX-focused skill, omission of that warning makes the content more dangerous because the domain is inherently high risk and users could interpret simple score thresholds as safe automated trading rules.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.