ClawHub
Back to skill

Security audit

Market Sentiment

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local market-sentiment analyzer that reads user-provided CSV data and outputs scores and trading-oriented suggestions, with no hidden network, credential, persistence, or destructive behavior found.

Install only if you want a local CSV-based market sentiment tool and understand that it produces financial decision-support suggestions. Review outputs manually before using them in any planner or trading workflow; do not wire the planner parameter directly into automated trading without separate human confirmation and risk controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documentation includes executable workflow examples that read from and write derived values from local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can let the skill operate with broader file access than users or orchestrators expect, increasing the chance of unintended local data access or unsafe composition with other scripts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is broad and generic, including common market-analysis phrases in both Chinese and English without clear activation boundaries. This can cause the skill to activate in unintended contexts, leading to over-broad routing, prompt injection exposure through unrelated user content, or accidental chaining into other financial-analysis components.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The only natural-language content in the file is a Chinese comment stating the implementation uses the Python standard library. Because the file provides content in a single language with no opt-in or explanation of a required locale, it may conflict with a policy requiring language choice or justified locale constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The disclaimer claims the tool is not investment advice, but the code later provides direct operational recommendations like reducing positions, adding exposure, and fixed stop-loss levels. This mismatch is dangerous because it can mislead users, reviewers, or orchestrating agents into underestimating the advisory nature and risk of the tool while still acting on prescriptive outputs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is a true issue: the skill does not only summarize market sentiment, it emits concrete trading guidance such as position sizing, stop-loss thresholds, and planner integration parameters. In an agent ecosystem, downstream tools or users may treat these outputs as authoritative execution inputs, creating unsafe automation and decision-support beyond the declared scope of simple analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file contains user-facing natural-language content in Chinese for key changelog sections and feature descriptions, while the file does not indicate that the skill is intentionally region- or language-specific. Under the language/locale policy, forcing a specific language without user opt-in or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README shows a strong/overbought market example that results in a bearish planner parameter, which is semantically inconsistent and can invert downstream trading behavior when users copy the integration pattern. In a financial decision-support skill, misleading parameter mapping is dangerous because it can systematically cause the consumer tool to take the opposite posture from the analyzed market state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The display name and description are written primarily in Chinese, and the file provides no indication that users can choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. This can violate language/locale policy when a skill imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural-language content entirely in Chinese, including the module docstring, CLI help, warnings, errors, and generated output. The policy for this category flags language/locale constraints when a specific language is imposed without user opt-in or an explicit documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.