ClawHub
Back to skill

Security audit

Stock Watcher

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward stock watchlist tool that stores a local watchlist and fetches public stock pages, with only limited data-loss risk from clear or uninstall commands.

Install only if you are comfortable storing a local stock watchlist under ~/.clawdbot/stock_watcher and sending stock codes to 10jqka.com.cn for lookups. Be careful with clear and uninstall commands because they can delete the saved watchlist data without an undo step.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill describes file read/write and network behavior but does not declare corresponding permissions. That creates a transparency and consent gap: users or the platform may invoke a skill that can modify local state and contact an external site without explicit capability disclosure. In this context, the behavior is aligned with the stock-watcher purpose, so the issue is not hidden malicious functionality, but it is still a real security and governance problem.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The description emphasizes watchlist management and monitoring, but the documented behavior also includes destructive operations such as clearing the entire watchlist and uninstall-time deletion of related files. Those actions may be functionally related, yet they materially increase risk because they can destroy user data beyond what a user may expect from a monitoring skill. The mismatch is more dangerous because users may authorize or invoke the skill based on an incomplete understanding of its destructive capabilities.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger language is broad enough that the skill could activate for loosely related stock questions without a precise boundary. Over-broad activation can cause unintended network requests, local file modifications, or destructive actions in the wrong conversational context, especially for management commands. Given this skill can write and clear persisted watchlist data, weak activation criteria raise the risk of accidental state-changing execution.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly documents complete watchlist clearing but does not state any confirmation or safeguard. A bulk-delete operation without a warning is dangerous because a mistaken invocation, ambiguous parsing, or prompt confusion can irreversibly erase the user's saved stock list. The context makes this materially relevant because the watchlist is persistent local data, not a transient view.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.