ClawHub
Back to skill

Security audit

Futures Quant

Security checks across malware telemetry and agentic risk

Overview

This skill is a futures-trading assistant that clearly describes live order execution and leverage use but does not provide adequate risk gating or user-confirmation boundaries.

Review carefully before installing. Use this only in paper-trading, sandbox, or backtesting mode unless you have independently verified the package, broker connection, credentials, strategy code, leverage settings, and risk controls. Do not allow an agent to run strategies, set leverage, or place orders without explicit human approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation description is extremely broad and ambiguous, repeatedly claiming applicability to general financial analysis, automation, and decision support without clear boundaries. In an agent environment, this can cause the skill to be invoked outside its safe operating scope, increasing the chance that high-impact trading-related actions are suggested or executed in inappropriate contexts.

Missing User Warnings

High
Confidence
96% confidence
Finding
These sections describe automated trading and order execution capabilities as normal features, but do not prominently warn that such actions can create real financial exposure, losses, or unintended market activity. Because the skill advertises direct CTP/trading integration and execution modules, lack of risk gating materially raises the danger beyond a purely informational finance skill.

Missing User Warnings

High
Confidence
98% confidence
Finding
The quick-start guide gives step-by-step instructions to install, initialize, configure leverage, and run a strategy, which operationalizes live trading behavior without any explicit warning about real-market impact. Presenting executable setup steps in a trading context can lead users or agents to move directly from setup to live execution, especially since the skill also declares exec capability.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.