ClawHub

TradeMemory Protocol

Security checks across malware telemetry and agentic risk

Overview

TradeMemory is a disclosed trading journal and analysis skill, but users should handle its broker credentials and trade data carefully.

Install only if you are comfortable storing trade history locally and, for MT5 sync, providing broker credentials. Prefer demo or read-only investor credentials where possible, keep .env private with restrictive permissions, do not commit it, keep TRADEMEMORY_API on localhost unless you control the endpoint, and manually review any trading or lot-size recommendations before applying them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares environment variables and explicitly describes network activity during installation and optional runtime API communication, but it does not declare corresponding permissions in a structured permissions section. That mismatch can cause the platform or user to underestimate what the skill can access, especially because it handles credentials and may send trade-pattern data to remote endpoints if configured.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script instructs the user to place MT5 account credentials into a local `.env` file in plaintext and does not clearly warn about the sensitivity of that file or recommend restrictive file permissions. On a shared workstation, backed-up home directory, or repository directory that may later be committed, those credentials could be exposed and allow unauthorized access to the trading account.

Credential Access

High
Category
Privilege Escalation
Content
cd tradememory-protocol

# 3. Configure credentials
cp .env.example .env
# Edit .env with your MT5 login, password, server

# 4. Start the TradeMemory server
Confidence
74% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
# 3. Configure credentials
cp .env.example .env
# Edit .env with your MT5 login, password, server

# 4. Start the TradeMemory server
python -m src.tradememory.server
Confidence
72% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
if [ ! -f ".env" ]; then
    echo "[3/4] Setting up credentials..."
    if [ -f ".env.example" ]; then
        cp .env.example .env
    else
        cat > .env << 'ENVEOF'
# MT5 Account
Confidence
86% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
if [ -f ".env.example" ]; then
        cp .env.example .env
    else
        cat > .env << 'ENVEOF'
# MT5 Account
MT5_LOGIN=your_login_here
MT5_PASSWORD=your_password_here
Confidence
92% confidence
Finding
.env

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal