ClawHub
Back to skill

Security audit

StockMaster Hunter IB Report Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its report-generation purpose, but it can expose sensitive investment reports through public upload and gives directive trading guidance, so it should be reviewed before installation.

Install only if you are comfortable with a skill that creates persistent local financial reports and may upload report assets to public URLs. Do not include sensitive portfolio details unless you intend them to appear in generated files, and ask the agent to keep delivery local-only unless you explicitly want public links.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill promises end-to-end investment research generation from a stock code or company name, but the behavior described by analysis includes opening local HTML in Chrome, converting it to PDF, and depending on precomputed structured inputs instead of performing the full claimed workflow. This mismatch is dangerous because users may trust the skill with sensitive financial inputs or rely on outputs under false assumptions about what data was gathered, validated, or generated, increasing the risk of misleading results and unsafe handling of local content.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to upload generated HTML and chart files using a public file-upload mechanism to obtain public URLs, but it does not require explicit user consent or warn that the contents may become publicly accessible. Because the reports can contain portfolio holdings, cost basis, and sensitive financial analysis, this creates a real confidentiality risk if files are exposed beyond the user's intended audience.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill mandates saving reports and charts into local directories, including user-specified paths, without clearly informing the user that files will be created on disk. While local file creation is expected for report generation, the lack of notice can still cause unintended persistence of sensitive financial content or writing into locations the user did not fully anticipate.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This section provides concrete buy, hold, take-profit, and stop-loss instructions with highly directive language, but does not include any warning that the content is educational, uncertain, and subject to market risk. In the context of an investment-report generation skill, users may reasonably treat the output as actionable financial advice, increasing the chance of financial harm from overreliance on the model's recommendations.

Static analysis

No suspicious patterns detected.