US Stock Analyst by leading AI LLM models with Bloomberg Data, Twitter Sentiment and Wall Street Equity Research Reports

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:29 PM UTC
• Version: 1.0.1

Overview

This skill is a cloud-backed stock analysis helper whose network and API-key use match its stated purpose, with some privacy and coding cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable using AIsa as a third-party cloud provider for your stock research. Avoid submitting confidential portfolios or proprietary investment theses, monitor API credit costs, and treat generated investment analysis as informational. Prefer fixing the unsanitized report filename and dependency pins before using it in automated or multi-user workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stock_analyst.py:536

Finding

Path Traversal Through Unsanitized Ticker in Report Filename

Content

View full analysis

.json` to the attacker-controlled path. 5. `open(filename, "w")` resolves the traversal and writes outside the current directory. 6. If the resolved destination already exists and the process can write to it, the destination is truncated and replaced with JSON report content. ### Impact Assessment Exploitation grants filesystem write capability under the privileges ...[truncated 455 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unnecessary and Insufficiently Constrained Third-Party Dependencies

Content

View full analysis

=0.24.0 asyncio ``` The documentation also instructs users to install these packages: ```bash pip install httpx asyncio pip install -r requirements.txt ``` ### Technical Analysis `asyncio` is included in the supported Python standard library and does not need to be installed from PyPI. Requesting a third-party package with that name unnecessarily expands the supply-chain trust boundary and may cause users to install code unrelated to the standard-library module they intend to use. The `httpx>=0.24.0` requirement has no upper bound or reviewed lock. A future installation may therefore resolve to a materially different release than the version reviewed during this audit. The manifests also do not provide hashes, preventing package-content verification and reproducible installation. This finding does not establish that the currently resolved packages are malicious. The risk arises from unnecessary package retrieval and mutable, insufficiently constrained dependency resolution. ### Attack Path 1. A user follows the README or installs the provided requirements. 2. `pip` contacts the configured package index. 3. It retrieves the unnecessary third-party `asyncio` distribution and the newest compatible `httpx` release. 4. Installation or later import executes code supplied by those external distributions under the user’s privileges. 5. A compromised, substituted, or unexpectedly changed distribution could affect the Skill environment. ### Impact Assessment A compromised dependency would execute with the same privileges as the Python environment performing installation or ...[truncated 310 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stock_analyst.py:291

Finding

Prompt Injection Through Untrusted News, Web, and Social-Media Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (82)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · US Stock Analyst 0210v1/SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · US Stock Analyst 0210v1/basic_analysis.py (reported line 21)May include surrounding context.

python

async def main():
    """Run basic stock analysis."""
    
    # Get API key from environment
    api_key = os.environ.get("AISA_API_KEY")
    if not api_key:
        print("Error: AISA_API_KEY environment variable not set")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · examples/basic_analysis.py (reported line 21)May include surrounding context.

python

async def main():
    """Run basic stock analysis."""
    
    # Get API key from environment
    api_key = os.environ.get("AISA_API_KEY")
    if not api_key:
        print("Error: AISA_API_KEY environment variable not set")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises use of environment secrets, network access, and a Python script, but does not declare an explicit permission or allowed-tools scope. That weakens least-privilege controls and makes it harder for a host agent or user to understand that prompts, tickers, and API-backed analysis may trigger outbound requests and local file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill encourages portfolio monitoring and free-form analysis prompts but does not warn users that their watchlists, prompts, and possibly derived investment context may be transmitted to third-party services including search, social, YouTube, and LLM endpoints. This is a real privacy and transparency issue because portfolio composition and research intent can be sensitive financial information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill repeatedly relies on the external domain api.aisa.one, meaning user inputs and API-authenticated requests leave the local environment. That is expected functionality, but it is still a true egress risk because sensitive portfolio or prompt data could be shared with a third party without sufficiently prominent notice.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill repeatedly relies on the external domain api.aisa.one, meaning user inputs and API-authenticated requests leave the local environment. That is expected functionality, but it is still a true egress risk because sensitive portfolio or prompt data could be shared with a third party without sufficiently prominent notice.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Historical price lookups send analysis parameters to a third-party API and therefore create an outbound data path. While the payload appears low sensitivity in isolation, combined requests can reveal a user's holdings, timing, and research patterns.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

Historical Stock Prices

bash

# Daily prices for last 30 days
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-01-01&end_date=2025-01-31&interval=day&interval_multiplier=1" \
  -H "Authorization: Bearer $AISA_API_KEY"

# 5-minute intraday data

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Intraday price queries are another external transmission path and may reveal highly time-sensitive trading interest or monitoring behavior. In a finance context, even ticker plus time-window metadata can be sensitive when tied to a user's portfolio activity.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

5-minute intraday data

curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-02-07&end_date=2025-02-07&interval=minute&interval_multiplier=5"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Fetching financial statements from an external provider is expected, but it still exposes which companies and analyses the user is interested in. The risk is moderate because the skill combines many such data pulls into a detailed profile of user research behavior.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Financial Statements

bash

# All statements (income, balance, cash flow)
curl "https://api.aisa.one/apis/v1/financial/financial_statements/all?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Analyst estimate queries are externally transmitted and contribute to a broader pattern of data egress. Although the endpoint itself is not suspicious, the skill context makes the aggregate profiling risk real because repeated use may disclose strategy and investment focus.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

Analyst Estimates

bash

# EPS forecasts and ratings
curl "https://api.aisa.one/apis/v1/financial/analyst/eps?ticker=AAPL&period=annual" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

Insider trade requests send user-selected securities to an outside API. This is normal for the feature, but still a true security/privacy concern because the skill lacks strong user-facing warning that research inputs are exported.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Insider Trading

bash

# Track insider buy/sell activity
curl "https://api.aisa.one/apis/v1/financial/insider/trades?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

Institutional ownership lookups are another external data transfer mechanism. The danger is not the endpoint itself but the undisclosed accumulation of user research metadata across repeated authenticated requests.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Institutional Ownership

bash

# See who owns the stock
curl "https://api.aisa.one/apis/v1/financial/institutional/ownership?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

SEC filing retrieval requires outbound network access and reveals which issuers the user is investigating. In this skill, that behavior is central rather than malicious, but it remains a genuine egress risk due to missing transparency and permission scoping.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

SEC Filings

bash

# Access 10-K, 10-Q, 8-K filings
curl "https://api.aisa.one/apis/v1/financial/sec/filings?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

News retrieval sends selected tickers to a third-party service and may expose ongoing research topics. Because the skill promotes portfolio monitoring, this can leak holdings or interests over time if users are unaware of the data sharing.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Company News

bash

curl "https://api.aisa.one/apis/v1/financial/news?ticker=AAPL&limit=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The web-search endpoint can transmit free-form analysis queries such as 'stock analysis' prompts to an external service, not just simple tickers. That increases sensitivity because users may include proprietary theses, portfolio context, or confidential reasoning in prompts that leave the local environment.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Web Search (News & Articles)

bash

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AAPL+stock+analysis&max_num_results=10" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

Academic search also transmits free-form research queries externally. While useful, it expands the privacy surface by exporting potentially sensitive sector theses or investment themes beyond the user's environment.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

Academic Research

bash

curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=semiconductor+industry+analysis&max_num_results=5" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

Twitter search for cashtags sends user interests to an external provider and may involve collection of social-content-derived signals. In a finance workflow, this can reveal portfolio surveillance or strategy focus, especially when combined with other endpoints.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

Twitter Search

bash

curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=\$AAPL&queryType=Latest" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

YouTube search transmits company-related queries to an external service and adds another third-party data flow not prominently disclosed to users. The security issue is moderate because it broadens exposure of user interests and may involve locale-specific metadata.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

YouTube Search (Earnings Calls, Analysis)

bash

curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AAPL+earnings+call&gl=us&hl=en" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The LLM gateway sends user prompts and analysis context to a remote model endpoint, which is materially more sensitive than simple ticker lookups because prompts can contain portfolio details, investment theses, or confidential instructions. This creates a significant data-exposure and third-party processing risk if users are not clearly informed and the host cannot constrain model egress.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

LLM Gateway (OpenAI Compatible)

bash

curl -X POST "https://api.aisa.one/v1/chat/completions" \
  -H "Authorization: Bearer $AISA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The documented dependency on https://api.aisa.one/ confirms that the skill relies on external network calls for core functionality. This is not inherently malicious, but it is a genuine security/privacy concern when users are not clearly warned that prompts, research queries, and metadata may be transmitted off-platform.

Content

Scanner excerpt · US Stock Analyst 0210v1/SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The documented dependency on https://api.aisa.one/ confirms that the skill relies on external network calls for core functionality. This is not inherently malicious, but it is a genuine security/privacy concern when users are not clearly warned that prompts, research queries, and metadata may be transmitted off-platform.

Content

Scanner excerpt · US Stock Analyst 0210v1/SKILL.md (reported line 59)May include surrounding context.

Real-time Financial Metrics

bash

curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Historical price lookups are performed against an external endpoint, meaning user-requested tickers, time ranges, and associated metadata are disclosed to a third party. In context this is expected behavior, but it still constitutes real data transmission risk if user interests or trading strategy are sensitive.

Content

Scanner excerpt · US Stock Analyst 0210v1/SKILL.md (reported line 68)May include surrounding context.

Historical Stock Prices

bash

# Daily prices for last 30 days
curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-01-01&end_date=2025-01-31&interval=day&interval_multiplier=1" \
  -H "Authorization: Bearer $AISA_API_KEY"

# 5-minute intraday data

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Intraday price requests also transmit query details to an external provider. Fine-grained intraday requests can reveal near-real-time trading interest or monitoring behavior, which may be sensitive in some environments.

Content

Scanner excerpt · US Stock Analyst 0210v1/SKILL.md (reported line 72)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

5-minute intraday data

curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-02-07&end_date=2025-02-07&interval=minute&interval_multiplier=5"
-H "Authorization: Bearer $AISA_API_KEY"

text

Static analysis

No suspicious patterns detected.