ClawHub
Back to skill

Security audit

Skill Cross Border Forex

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed forex calculation helper that uses an external exchange-rate API but does not show hidden data access, persistence, or account-changing behavior.

Install only if you are comfortable with live exchange-rate lookups going to Frankfurter API. Treat its profit and platform recommendations as estimates, not financial advice, and avoid feeding sensitive customer/order files unless you have reviewed what the local JSON input contains.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation condition is broad and role-based rather than task-scoped, which can cause the skill to trigger in loosely related conversations about cross-border e-commerce, finance, or pricing. In a finance-adjacent skill, overbroad activation increases the chance of unsolicited financial calculations or recommendations being injected into contexts where the user did not explicitly request exchange-rate analysis.

External Transmission

Medium
Category
Data Exfiltration
Content
def fetch_exchange_rate(from_currency: str, to_currency: str) -> float:
    """从Frankfurter API获取汇率"""
    url = f"https://api.frankfurter.app/latest"
    params = {
        "from": from_currency,
        "to": to_currency
Confidence
88% confidence
Finding
https://api.frankfurter.app/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.