ClawHub
Back to skill

Security audit

drt-trading

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only trading strategy guide with no hidden execution, network access, credential handling, or persistence, but its trading performance claims need user caution.

Treat this as educational trading analysis, not financial advice. Verify the backtest methodology independently, remember that live trading can lose money, convert CET/Danish times to your local timezone, and do not connect it to broker execution or account access without separate review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill provides concrete trading setup guidance and prominently cites very strong backtest win rates and returns, but it does not include any financial risk disclosure, uncertainty caveats, or warning that users can lose money. In this context, omission of loss/risk warnings can mislead users into overtrusting the strategy, especially because the performance claims are framed as recommended filters and actionable execution rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language instructions define execution windows specifically in CET/Danish time, which imposes a locale-specific operating context. The file does not offer conversion guidance, opt-in, or explain that the skill is limited to a Danish/CET audience, so this is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.