ClawHub
Back to skill

Security audit

Indicator Lab

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward trading backtesting helper, with expected network and file permissions but thin disclosure and a missing referenced script.

Before installing, note that this skill is intended to fetch market data and may create output files. Use a project directory or virtual environment, and be aware that the referenced backtest script was not included in the inspected artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This manifest is in scope for SQP-2 because markdown files can provide the user-facing warning, and the manifest itself advertises potentially safety-relevant behaviors through its permissions. The description explains backtesting functionality but does not disclose that the skill may access the network and write files, which could affect user data or system state.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.