ClawHub

Trade Memory

Security checks across malware telemetry and agentic risk

Overview

This trade logger has a clear purpose, but it uses an unsafe shell command pattern and references an unreviewed helper script outside the packaged artifact.

Review before installing. Use only if you can verify the referenced save.py yourself, and prefer a version that bundles the helper script and passes input through stdin, a temp file, or a structured argument API instead of raw shell interpolation. Expect trade history to remain on disk at the configured path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill persistently stores user- or agent-provided trade data to a local file, but it does not require any explicit user-facing notice or confirmation that the data will be retained. This creates a privacy and consent issue because sensitive financial activity, strategy notes, or timestamps may be saved beyond the current session without the user's clear awareness.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow instructs the agent to run the save script automatically and then confirm success, without a mandatory user warning or confirmation step immediately before appending data. In practice, this can cause silent persistence of potentially sensitive trading information and increases the risk of unintended data retention from agent-generated or inferred trade details.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal