ClawHub
Back to skill

Security audit

Options Trading Brain

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it gives broad, actionable options-trading signals while overstating how its analysis works and omitting risk warnings.

Review this carefully before installing or using it for financial decisions. It does not appear to steal data or persist on the system, but its trading outputs are overconfident, incompletely implemented, and should not be treated as financial advice or automated trade recommendations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill advertises a 5-factor unified options signal, but the final scoring logic only evaluates whale, wave3, and squeeze while ignoring trend and liquidity entirely. This creates deceptive or overconfident outputs that users may rely on for financial decisions, especially because the documentation explicitly claims broader confirmation than the code actually provides.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The generator checks for a whale signal using the presence of a green circle emoji in script output, but the whale scanner never emits that marker. As a result, the documented requirement that whale flow be present becomes effectively broken, causing conviction logic to malfunction and potentially suppress or misclassify signals in a way that misleads users.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill presents itself as a professional-grade autonomous trading signal generator and offers actionable setups without any warning about financial risk, uncertainty, or potential loss. In a trading context, omission of risk disclosure can encourage unsafe reliance on the tool's outputs and magnify harm from inaccurate signals.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation guidance is broad enough to trigger on generic stock-analysis or ticker-checking requests, which can cause the skill to engage in situations where the user did not specifically request options-focused automated signals. In the finance context, over-triggering increases the chance of unsolicited or inappropriately authoritative trading guidance.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The Elliott Wave component claims to validate the three core Elliott Wave rules, but the implementation mainly counts local highs/lows and uses a simplified heuristic that does not enforce the documented constraints. This mismatch can produce false confidence in pattern-based trading signals and degrade the integrity of downstream signal generation.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
## Usage

Run any script directly:
```bash
python scripts/whale_scanner.py SPY
python scripts/elliott_wave.py NVDA
Confidence
80% confidence
Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Static analysis

No suspicious patterns detected.