ClawHub
Back to skill

Security audit

Portfolio Tracker

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real portfolio tracker, but it should be reviewed because broad trigger wording can lead to sensitive holdings being read, Yahoo Finance browsing, and local tracker edits from ambiguous finance requests.

Install only if you are comfortable with the skill reading the included portfolio holdings, opening Yahoo Finance through a browser profile, and editing portfolio-tracker.md. Prefer invoking it with explicit commands such as "update my portfolio tracker," and review generated files before sharing them because they may reveal portfolio composition.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill is configured to activate on very broad finance-related language, which increases the chance of being invoked when the user did not intend portfolio access or browser-driven updates. In this skill's context, that is riskier because activation can lead to reading sensitive holdings and modifying local tracking files based on live browsing activity.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill handles sensitive financial holdings and performs file updates, but it does not warn the user that it will access portfolio data and modify a local file. That omission can lead to privacy surprises, unintended disclosure of financial information, or accidental overwrites if the skill runs without informed user consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.