ClawHub
Back to skill

Security audit

Aky Select

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed stock screener that appears safe to run, but its results may overstate one of its screening conditions.

Install only if you are comfortable using AkShare to fetch public market data. Treat the output as a technical screen, not investment advice, and be aware that the current version may include stocks that fail or lack the VWAP/average-price condition despite saying all 9 conditions are met. Only add the cron entry if you want recurring weekday runs, and remove it from crontab when you no longer need it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This is a true integrity flaw: the script computes the VWAP/full-day average-line condition but does not reject candidates when that condition fails or is unknown. As a result, the tool can present stocks as matching a 9-condition strategy when they may only satisfy 8, which can mislead users into making trading decisions based on incorrect screening results.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
This is a true vulnerability in the form of misleading output and false assurance: the report states the returned stocks satisfy all 9 conditions even though the VWAP condition is not mandatory in selection. In a financial screening skill, inaccurate claims materially increase the chance of user harm because the output appears authoritative and complete.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.