Trade History

Security checks across malware telemetry and agentic risk

Overview

This skill is a narrow, disclosed tool for reading a local trade log, with the main caveat that it exposes private trading history and references a helper script not included in the submitted artifact.

Install only if you want your agent to read and summarize your local trading log. Treat the output as private financial information, use explicit requests when invoking it, and verify the referenced read.py helper exists and only reads the stated trades.jsonl file before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description is broad enough to match common requests about trade summaries, recaps, or listings, which can cause the agent to invoke this skill in situations the user did not explicitly intend. Because the skill reads local trading history from a fixed filesystem path, overbroad triggering can expose sensitive financial activity and metadata unnecessarily.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal