ClawHub

Scenario Forecaster

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only scenario forecasting skill with coherent files and no hidden code, but users should be careful with financial outputs and private data integrations.

Safe to install as an instruction-only skill if you understand its limits. Do not connect internal CRM, sales, or other private data sources without explicit least-privilege credentials, secret management, and compliance review. Treat any buy/sell/options suggestions as scenario-analysis output, not professional financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The guide encourages adding private data APIs such as internal CRM and sales systems, but provides no guidance on authentication, authorization, minimization, consent, or secure handling of sensitive data. In the context of a forecasting skill that aggregates multi-source inputs, this omission can lead deployers to connect sensitive enterprise data in unsafe ways, increasing the risk of data leakage, overcollection, or unauthorized access.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The prompt explicitly instructs the model to generate role-specific investment and trading actions, including concrete examples such as buying put options at a specific price, without requiring any financial-risk warning, suitability check, or limitation on personalized advice. In a forecasting skill aimed at investors and managers, this materially increases the chance that users treat speculative scenario output as actionable financial guidance, which can lead to harmful decisions or regulatory/compliance issues.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal