ClawHub
Back to skill

Security audit

Orderly Trading Orders

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent documentation for Orderly trading, but it teaches live financial order placement and broad cancellation flows without enough explicit guardrails.

Install only if you intentionally want an agent to help with Orderly trading workflows. Use a sandbox or limited account first, keep trading keys tightly scoped, require manual confirmation for every live order, prefer symbol-scoped cancellation, and set external order size, notional, and account limits before using batch or automated examples.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents destructive cancellation endpoints, including cancel-all behavior, without requiring confirmation, scoping safeguards, or explicit warnings about irreversible trading impact. In a trading context, this materially increases the risk of accidental mass order cancellation or agent misuse leading to financial loss and disruption of trading strategy.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill provides live order placement and authenticated trading examples without clearly warning that these actions execute real trades with immediate financial consequences. In an agentic or automated setting, such missing guardrails can cause unintended orders, losses, or unauthorized trading if integrated naively.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.