ClawHub
Back to skill

Security audit

Orderly Positions Tpsl

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent and non-executable, but it teaches live trading actions that can affect real funds without explicit confirmation or risk-review guardrails.

Review carefully before using with a real Orderly account. Prefer read-only credentials for monitoring, and require a clear confirmation step before any close, leverage change, order placement, TP/SL update, stop order, or cancellation, showing the exact symbol, side, size, leverage, trigger prices, reduce-only setting, and liquidation or loss impact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This section describes partial and full position closure using trading-scoped actions without any explicit warning that these operations can immediately and irreversibly change exposure or realize losses. In an agent skill context, omission of user-confirmation guidance increases the chance that an agent could execute destructive trades from ambiguous prompts or misunderstood intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
Changing leverage materially alters liquidation risk and required margin, yet the skill presents leverage modification as a simple UI action without warning or guardrails. In a trading agent setting, that omission is dangerous because an automated or misinterpreted leverage increase can rapidly move an account closer to liquidation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The TP/SL and algo-order sections describe creation of future-triggered orders that can automatically execute trades later, but they lack explicit warnings about unintended triggers, stale configurations, or incorrect side/price parameters. In an agent context this is especially risky because a malformed or misunderstood automated order may execute without further user interaction at a later time.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.