ClawHub
Back to skill

Security audit

StockIndexMonitor

Security checks across malware telemetry and agentic risk

Overview

This stock-monitoring skill is not shown to be malicious, but it asks users to run a missing background script for financial monitoring, so its real behavior cannot be reviewed from the package.

Review this carefully before installing. Do not run the referenced background control.sh unless you can inspect the actual script locally and understand what data sources it contacts, what it logs, how it stores your holdings and cost basis, and whether the stop command reliably terminates it. Treat any trading suggestions as research prompts, not investment advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Low
Confidence
83% confidence
Finding
The metadata slug in _meta.json identifies the skill as "stock-index-monitor" while the declared skill name is "stock-monitor," creating an identity and scope mismatch. This can mislead users, reviewers, or downstream tooling about what is being installed or published, and in security-sensitive ecosystems such inconsistencies can conceal repackaging, typo-confusion, or substitution of a different skill than expected.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.