ClawHub
Back to skill

Security audit

Fees Optimizations

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable trading-advice skill, but it gives materially risky stop-loss guidance that users should review before relying on it.

Install only if you treat it as fee-analysis reference material, not authoritative risk-management guidance. Before using its Freqtrade config in live or leveraged trading, verify stop-loss behavior against current Freqtrade, Hyperliquid, and Superior documentation and consider using exchange-side protection where supported.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
This guidance appears technically incorrect: an exchange-hosted stop is intended to trigger on exchange conditions, not wait for the bot's next candle-close polling cycle. In a trading-automation skill, misleading stoploss behavior can cause users to disable safer protections or rely on slower local handling, materially increasing liquidation and loss risk during fast moves.

Static analysis

No suspicious patterns detected.