ClawHub
Back to skill

Security audit

Financial Analysis

Security checks for vulnerabilities and agentic risk

Overview

This is a plain financial-analysis instruction file with no code execution, persistence, credential access, or hidden data movement.

This skill is appropriate for structured financial modeling support. Users should still avoid pasting confidential deal data unless they intend the agent to use it, verify assumptions and comparables, and treat outputs as analysis support rather than legal, tax, or regulated investment advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
- Assemble: one-pager, model summary, returns table, risk register, use-of-funds, structure/terms.
- Match the live deal terms exactly as provided.

## Output Rules
- State every assumption; flag provided vs. estimated.
- Always give a **range + sensitivity** — never single false-precision numbers.
- Sanity-check against comparables and reality; flag anything that looks off.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill advertises itself for broadly phrased 'capital raises, valuations, and any returns or valuation question,' which can cause over-invocation outside a narrowly scoped financial-modeling context. Broad routing increases the chance the agent will handle adjacent requests containing sensitive financial, legal, or strategic content without stronger gating or clarification, especially in investor-facing workflows.

Static analysis

No suspicious patterns detected.