ClawHub
Back to skill

Security audit

Prosperity Investing Framework

Security checks across malware telemetry and agentic risk

Overview

This is a coherent investment-research skill, but it should be reviewed because it automatically handles broad file/report inputs, writes persistent investment notes, and gives actionable trading guidance without clear consent boundaries or risk framing.

Install only if you want an agent to help maintain an investment-research notebook. Use it on intentionally provided research materials, require confirmation before it writes or updates investment files, and treat its stock timing and valuation outputs as research prompts rather than personalized financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill declares that any receipt of a report, document, link, or text for analysis will automatically trigger a workflow '无需用户提醒'. That scope is very broad and can cause unintended activation on loosely related inputs, leading the agent to perform file classification, archival, and investment-analysis actions without clear user consent. In an agent setting, broad auto-triggering increases the chance of prompt hijacking, context confusion, and unintended handling of sensitive user content.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list contains broad domain phrases such as '景气投资', '产业周期', and related common analytical terms without a strict invocation boundary. This makes accidental activation more likely during normal conversation about markets or macro trends, causing the skill to take over when the user may not have intended to invoke it. While not directly enabling code execution, it can still misroute user requests and amplify unsafe autonomous behavior defined elsewhere in the skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The file gives explicit investment timing and trading guidance such as when to enter, hold, avoid adding, and exit positions, but does so without any warning about financial risk, uncertainty, or suitability. In a skill designed to support stock selection and trading decisions, this omission can cause users to treat the content as actionable financial advice and make harmful decisions without understanding loss risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.