ClawHub
Back to skill

Security audit

Hype Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a market-hype scanner, but it also contains an undocumented trading-account monitor that can store account equity and positions, so it should be reviewed before installation.

Install only after removing or explicitly reviewing the trading-monitor integration. If you keep it, require opt-in, use read-only brokerage credentials, avoid storing raw equity or positions in alerts.json, restrict file permissions, and treat AI-generated market alerts as untrusted advice because public posts can influence the model prompt.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
scanner-ai.js:116
Finding

Untrusted Reddit Content Can Hijack Local AI Analysis and Alert Generation

Content
View full analysis
`"${p.title}" (${p.score}↑, r/${p.sub})`).join(' | ')}` : ''} ${candidate.coingecko ? `CoinGecko: Currently trending (rank ${candidate.coingecko.rank || 'N/A'})` : ''} ${candidate.dex ? `DEXScreener: - 1h price change: ${candidate.dex.priceChange1h}% - 24h price change: ${candidate.dex.priceChange24h}% - 1h volume USD: $${candidate.dex.volumeUsd1h?.toLocaleString()} - Pair age: ${candidate.dex.pairAge !== null ? candidate.dex.pairAge + 'h' : 'unknown'} - Chain: ${candidate.dex.chain}` : ''} ${candidate.stocktwits ? `StockTwits: Trending (watchlists: ${candidate.stocktwits.watchlist_count})` : ''} ## Your Analysis Task: 1. Is this signal REAL or NOISE? (Consider: multiple sources, momentum, volume, post quality) 2. What's the RISK level? ...[truncated 2971 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scanner-ai.js:395
Finding

Undocumented Trading-Account Integration Exceeds the Declared Skill Scope

Content
View full analysis
{ if (alerts.length > 0) { console.log('\n=== AI ALERTS ==='); for (const a of alerts) { console.log(`${a.urgency} ${a.ticker} | AI: ${a.ai_confidence}/10 | ${a.opportunity}`); } } // בדוק מסחר — דווח רק אם יש שינוי try { const trading = await checkTrading(); if (trading) { const tradingAlert = { ticker: '📊 Trading Update', type: 'trading', updates: trading.updates, equity: trading.equity, positions: trading.positions, urgency: '📊', timestamp: new Date().toISOString(), status: 'pending', sources: ['alpaca'], }; const fs = require('fs'); const existing = JSON.parse(fs.readFileSync(require('path').join(__dirname, 'alerts.json'), 'utf8')); existing.unshift(tradingAlert); if (existing.length > 200) existing.splice(200); fs.writeFileSync(require('path').join(__dirname, 'alerts.json'), JSON.stringify(existing, null, 2)); log(`📊 Trading update: ${trading.updates.join(' | ')}`); } } catch (e) { log(`Trading monitor error: ${e.message}`); } process.exit(0); }).catch(e => { log(`FATAL: ${e.message}`); process.exit(1); }); ``` ### Technical Analysis The declared Skill functionality is public-source cryptocurrency and stock hype detection using Reddit, CoinGecko, DEXScreener, StockTwits, and a local Ollama model. The documentation does not declare access to a brokerage integration, account equity, open positions, or an Alpaca data source. Nevertheless, the implementation unconditionally imports `./trading-monitor` at module initialization and calls `checkTrading ...[truncated 2624 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose is a hype scanner, but the static finding indicates additional undeclared trading-monitor behavior and Alpaca-related account/status access. Hidden access to trading data or account state materially expands the trust boundary and could let a user install a market-sentiment tool that also observes or influences trading operations without informed consent.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
Clone or copy `scanner-ai.js` to your workspace:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
Clone or copy `scanner-ai.js` to your workspace:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Describing the system as autonomous and silent encourages unattended execution while omitting warnings about persistent local files, scheduled tasks, and continuous monitoring. That increases operational risk because users may deploy it without understanding that it runs indefinitely, stores state, and may trigger downstream actions automatically.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for detecting crypto and stock hype using market/social data sources and a local Ollama model. However, the architecture and setup instructions add a messaging/notification capability via Telegram, which is not part of the stated detection function and introduces an outbound communication behavior beyond the core scanning purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

These instructions direct an agent to autonomously read local files, send Telegram messages, and mutate alert state by marking entries as seen. That creates side effects and external data transmission beyond passive scanning, and users are not given clear consent or safeguards around what is sent or changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown instructs autonomous file modification and Telegram messaging without an explicit warning about local state changes and outbound communications. In an agentic environment, this can lead to silent exfiltration of alert content or unintended workflow execution because users may assume the skill is analysis-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s natural-language comments and user-visible status/log strings are written in Hebrew throughout, including startup, analysis, and completion messages. For a general-purpose scanning skill, this imposes a specific language without user opt-in or any documented justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scanner-ai.js (reported line 135)May include surrounding context.

js
async function scanCoinGecko() {
  try {
    const data = await fetchJSON('https://api.coingecko.com/api/v3/search/trending');
    return (data?.coins || []).map(c => ({
      ticker: c.item.symbol.toUpperCase(),
      name: c.item.name,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scanner-ai.js (reported line 148)May include surrounding context.

js
async function scanDexScreener() {
  try {
    // שלב 1: קבל top boosted tokens
    const boosts = await fetchJSON('https://api.dexscreener.com/token-boosts/top/v1');
    if (!Array.isArray(boosts) || boosts.length === 0) return [];

    // שלב 2: קבל פרטים בbatches של 30

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scanner-ai.js (reported line 153)May include surrounding context.

js
async function scanDexScreener() {
  try {
    // שלב 1: קבל top boosted tokens
    const boosts = await fetchJSON('https://api.dexscreener.com/token-boosts/top/v1');
    if (!Array.isArray(boosts) || boosts.length === 0) return [];

    // שלב 2: קבל פרטים בbatches של 30

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scanner-ai.js (reported line 191)May include surrounding context.

js
async function scanStockTwits() {
  try {
    const data = await fetchJSON('https://api.stocktwits.com/api/2/trending/symbols.json');
    return (data?.symbols || []).slice(0, 30).map(s => ({
      ticker: s.symbol,
      name: s.title,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is ներկայացված as a hype scanner, but it also invokes a trading monitor and persists account-related trading updates into alerts.json. This is a scope expansion into brokerage/account telemetry that users would not reasonably expect from the declared functionality, creating an unnecessary data-access and data-retention risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Monitoring brokerage/trading account state is not justified by the stated purpose of detecting market hype from public sources. Even without direct order placement, collecting equity, positions, and updates increases exposure of sensitive financial information and broadens the blast radius if logs or alert files are accessed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill is described as identifying early hype signals, but this section instructs another agent workflow to consume alerts for briefing output and mark them as seen. That reporting/state-management behavior is not inherent to hype detection itself and is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.