ClawHub
Back to skill

Security audit

TradingView技术指标分析助手

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Prana wrapper that sends requests to Prana and may store a Prana API key locally; it is not a local-only indicator library.

Install this only if you are comfortable using Prana as a remote service. Your prompts and task data are sent to the configured Prana base URL, and first-run setup may use ACCOUNT_ID, EMAIL, or PHONE_NUMBER from the environment and may save an API key under config/api_key.txt unless disabled. Use PRANA_SKILL_NO_AUTO_API_KEY=1 or PRANA_SKILL_SKIP_WRITE_API_KEY=1 if you do not want automatic key provisioning or local key storage.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises no permissions, yet associated behavior indicates access to environment variables, filesystem read/write, and network communication. This mismatch is dangerous because users and policy systems may trust the skill as low-risk while it can exfiltrate data, persist secrets, or invoke remote services outside the stated scope.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared purpose is local technical-analysis tooling, but the observed behavior includes credential acquisition/storage and forwarding user input to external Prana endpoints for remote execution. This is dangerous because it conceals material data flows and trust boundaries: user prompts, configuration, and possibly secrets may be transmitted off-box under the guise of a local analytics skill.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
该文件明确指导用户在技能目录中配置 Prana 的 public_key/secret_key，且这与声明的“TradingView 技术指标分析”功能并不一致，说明技能实际能力边界与对外描述存在偏差。即使文件当前仅为注释，这种设计也会诱导部署者放入敏感凭证，为后续被技能代码读取、外传或滥用创造条件。

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
对一个本应提供本地技术指标计算/分析的技能而言，文档却引导配置外部交易或服务 API 凭证，属于超出合理最小能力范围的敏感权限扩张。这样的上下文不匹配会增加供应链与凭证泄露风险：用户可能在不了解真实用途的情况下授予不必要的访问能力。

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill is presented as a local Python technical-analysis toolset, but the code is explicitly a thin client that forwards user input to a remote Prana service for execution. This is a serious trust-boundary violation because users may provide market data, prompts, or other sensitive inputs under the assumption they remain local, while the actual behavior exfiltrates that data to an external service.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
This code automatically provisions API credentials from a remote service and stores them for later use, which is unrelated to a normal local technical-indicator analysis utility. Unnecessary credential handling expands the attack surface, creates persistence of secrets on disk, and enables silent coupling of the skill to a remote account/service.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The client constructs a GET request that may include account_id, email, and phone_number from environment variables and sends them to the remote API without an explicit user-facing disclosure at the call site. This can leak identifying information unexpectedly and may create or link remote accounts without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Fetched API credentials are persisted to config/api_key.txt by default, with optional JSON persistence as well, and there is no interactive warning or confirmation before writing secrets to disk. Plaintext secret storage increases the risk of credential theft through accidental commits, local compromise, backups, or multi-user system access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.