ClawHub
Back to skill

Security audit

财经新闻深度分析技能

Security checks across malware telemetry and agentic risk

Overview

This finance news skill appears purpose-aligned, but it should go to Review because it can auto-activate on broad finance/news words and then browse, generate, and save investment-oriented reports.

Install only if you want a finance-focused skill that may browse public financial sites and save local reports or cached results. Use explicit invocations, avoid entering sensitive portfolio details unless needed, review any cron/watch setup before enabling it, and treat all market labels as research rather than financial advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
95% confidence
Finding
The activation keywords are extremely broad, including generic terms like '新闻', '投资', '金融', company names, and sector names, making accidental invocation likely during ordinary conversation. Over-broad triggering is dangerous because it can cause unintended browsing, data fetching, report generation, or storage actions without clear user intent, expanding the skill's authority surface.

Vague Triggers

High
Confidence
94% confidence
Finding
The earlier '触发条件' section repeats the same problem by auto-activating on broad finance words, company names, and industries without requiring an explicit request to use the skill. In context, this is more dangerous because the skill is designed to perform network retrieval and potentially save results, so false activations can trigger unnecessary external actions and expose user context to third-party sites.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.