ClawHub
Back to skill

Security audit

technical-indicator-signal-engine

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed technical-analysis skill with an optional public-market-data demo fetch, not hidden credential access or persistence.

Before installing, understand that this skill can generate market-trading signals and includes an optional OKX public-data fetch if its demo code is run. Do not treat its outputs as investment advice, and only run live-data examples when you are comfortable making outbound requests to market-data providers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
76% confidence
Finding
The skill advertises a pandas-based analysis engine but also indicates network capability via requests/OKX data fetching without any declared permission boundary. Hidden or undeclared network access can cause unexpected external data exfiltration or remote dependency behavior in environments that assume local-only analysis.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior does not match the implemented behavior: the skill is described as pure-pandas and arbitrary-OHLCV driven, yet it reportedly performs live HTTP fetching and includes undocumented indicators/logic. This mismatch is dangerous because reviewers and users may trust the skill under false assumptions, allowing unexpected network activity and analysis outputs that differ from the published methodology.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.