ClawHub
Back to skill

Security audit

Stock Analysis Expert

Security checks across malware telemetry and agentic risk

Overview

This skill has no executable behavior, but it presents high-stakes stock buy/sell recommendations while also saying it is not investment advice.

Install only if you want an informational stock-analysis prompt and will independently verify all market data and recommendations. Do not rely on this skill as personalized investment advice, and be cautious with its advertised accuracy, target prices, stop-losses, and buy/sell signals.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill simultaneously advertises '专业股票分析报告（含投资建议）', '实时买卖信号', target prices, stop-loss levels, and strong recommendations, while later disclaiming that it does not constitute investment advice. This inconsistency can mislead users and downstream agents about the intended use, potentially causing reliance on regulated or high-stakes financial guidance without appropriate controls, disclosures, or suitability checks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.