ClawHub
Back to skill

Security audit

Stock Research Team (Simplified)

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese-language stock research skill that gathers market/news data and produces investment-style analysis, with no hidden persistence, credential access, or automatic destructive behavior found.

Install only if you want Chinese stock research reports and are comfortable with the skill using market-data and web-search tools. Review the upgrade command before running it manually, because it deletes the named old skill directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The markdown consistently instructs operation and output in Chinese, including the Chinese description, Chinese output template, and Chinese-only search phrasing for key workflow steps. The file does not offer the user a language choice or state that Chinese is optional, which can violate a language/locale policy requiring user opt-in.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The changelog states that the trigger keyword remains "分析 X 股票", but provides no constraints, negative examples, or activation boundaries. This phrase is broad enough to overlap with ordinary requests to analyze a stock, which could cause unintended invocation if used as an activation phrase.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This markdown file is entirely written as mandatory rating guidance in Chinese and gives no indication that another language may be used or that the Chinese-only requirement is optional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is explicitly justified.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 升级路径（适用从 v3.x 升级的用户）

1. 删除本地旧版本：`rm -rf skills/stock-research-team`
2. 安装 v4：`clawhub install tanteng-stock-research`
3. 触发关键字不变（"分析 X 股票"），但失去 `mode: full` 的多 agent 升级能力
4. 如确需多 agent 深度复盘，回到上游 `stock-research-team` 原版
Confidence
26% confidence
Finding
rm -rf skills/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.