ClawHub
Back to skill

Security audit

Crypto Trading Decision Framework

Security checks across malware telemetry and agentic risk

Overview

This is a text-only crypto trading checklist that can influence financial decisions but does not request credentials, install code, or execute trades.

Install only if you want a trading decision checklist. Treat outputs as informational risk-management guidance, not professional financial advice or permission to trade. Verify market data independently, keep all live-trading decisions under your control, and avoid sharing sensitive portfolio or account details with extra model providers unless you understand that data flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The invocation scope is broad enough to trigger on general trading discussions, which increases the chance the agent will provide actionable financial guidance in contexts that may be ambiguous, insufficiently informed, or inappropriate. In a finance skill that includes position sizing, exits, and live trade management, over-broad invocation materially raises the risk of unsafe or overconfident recommendations reaching users without adequate gating.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill gives detailed real-money trading guidance, including capital deployment, leverage caps, stop-loss handling, and a structured trade recommendation format, but does not present an explicit financial-risk warning or clear limitation that outputs are informational rather than professional advice. Because the content is designed to shape live trading behavior, omission of prominent risk disclosure and suitability boundaries makes harmful reliance more likely, especially for inexperienced users.

VirusTotal

40/40 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.