Beta Market Brief

• Outcome: Review
• Latest audit: May 29, 2026, 9:29 PM
• Version:
  1.0.0

Overview

This market-brief skill has a reasonable purpose, but it tells the agent to run an unreviewed hard-coded local Python script whenever broad market-brief triggers match.

Install only if you control and have reviewed the referenced `tiger_market_brief.py` script and its Tiger API configuration. Confirm it only reads market data, does not place trades or access unrelated account data, and use the skill only for explicit Tiger market-brief requests.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill description is broad enough to match generic market-update or brief requests, which can cause the agent to invoke this skill in situations where the user did not explicitly ask for Tiger-sourced output or script execution. That increases the chance of unintended tool use, unnecessary external data access, and responses being constrained by the skill's fixed workflow instead of the user's actual request.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description requires a Chinese market brief regardless of user preference, which can override user intent and produce outputs in an unexpected language. While this is not a direct code-execution issue, it is a prompt-safety and usability problem because the skill can force an unintended response format when auto-selected.

VirusTotal

63/63 vendors flagged this skill as clean.