ClawHub
Back to skill

Security audit

Financial Calculator Pro

Security checks across malware telemetry and agentic risk

Overview

This is a coherent financial calculator skill with normal local CLI and web UI behavior, with some ordinary dependency and local-server cautions.

Install if you are comfortable with a local Flask calculator that may install Flask into a venv and load Chart.js from a CDN. Use it on a trusted network, avoid entering highly sensitive financial details, and consider binding the server to localhost only or bundling Chart.js locally for a tighter setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The page loads executable JavaScript directly from a third-party CDN, which gives that external source the ability to run code in the context of the calculator UI. If the CDN, dependency, or delivery path is compromised, user financial inputs and page behavior could be altered or exfiltrated, which is unnecessary risk for a local financial calculator.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.