yahooquery

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:45 PM UTC
• Version: 1.0.0

Overview

This is a Yahoo Finance documentation skill with user-controlled install and network use; it has insecure examples users should avoid, but no hidden execution, persistence, or deceptive behavior was found.

Install in a virtual environment, pin yahooquery and dependencies when reproducibility matters, keep Yahoo credentials in a protected secret store or injected environment rather than source files, and do not use `verify=False` with real traffic or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:240

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 240
Vulnerability Type: Unpinned dependency and mutable software supply chain
Risk Level: Medium

Vulnerable Code

markdown

- **Installation**: `python3 -m pip install yahooquery`

Technical Analysis

The installation instruction retrieves the current yahooquery release and its transitive dependencies without a version constraint, lock file, package hash, or reviewed source reference. Consequently, the software installed when the Skill is used may differ from the version that existed during this audit.

Python packages can execute code during package building or installation and subsequently when imported. If the package index, a future package release, or a transitive dependency is compromised, following this instruction could introduce attacker-controlled code into the Agent environment.

No evidence establishes that the current yahooquery package is malicious. The vulnerability is the absence of dependency integrity and reproducibility controls.

Attack Path

1. An attacker compromises a future yahooquery release, one of its transitive dependencies, or the package distribution channel.
2. A user or Agent follows the documented python3 -m pip install yahooquery instruction.
3. The package manager resolves and downloads the mutable, attacker-controlled release.
4. Malicious code executes during package installation, build processing, or a later import yahooquery.
5. The code operates with the privileges of the user or Agent process that performed the installation or import.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing Agent user's privileges. Depending on that account's access, this could expose local files, environment variables, Yahoo credentials, session material, network-accessible resources, and data processed by the Agent. The instruction does not itself reque ...[truncated 94 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yahooquery to a specifically reviewed version rather than installing the latest release.
2. Pin all transitive dependencies using a generated lock file.
3. Require package hashes, for example through a requirements file used with pip --require-hashes.
4. Document the approved package index and prohibit untrusted extra indexes.
5. Install the dependency in an isolated virtual environment or container with minimal filesystem and network permissions.
6. Add automated dependency vulnerability, provenance, and integrity checks to the release process.
7. Re-audit the pinned package version before changing the dependency lock.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/keyword_arguments.md:348

Finding

TLS Certificate Verification Can Be Disabled by a Copyable Example

Content

View full analysis

Vulnerability Details

File Location: references/keyword_arguments.md, lines 348-353
Vulnerability Type: Insecure TLS configuration
Risk Level: Medium

Vulnerable Code

python

Ticker(
    'aapl',
    verify=False
)

Technical Analysis

The documentation supplies a directly copyable configuration that disables TLS certificate verification. With verify=False, the client no longer authenticates the remote server through its certificate chain. Encryption alone therefore does not prevent an active network attacker from impersonating the intended service.

An attacker capable of intercepting traffic, such as an operator of a malicious proxy, compromised gateway, hostile wireless network, or poisoned network route, could terminate the TLS connection using an untrusted certificate. The attacker could then observe or alter requests and responses accepted by the client.

This risk is especially relevant because the documented library supports Yahoo Premium authentication and reusable session and crumb values. The precise exposure depends on the endpoints used and the library's handling of authentication material. No actual interception or credential theft is present in the audited files.

Attack Path

1. A user copies the documented verify=False example into a Ticker configuration.
2. The user runs the client over a network controlled or intercepted by an attacker.
3. The attacker redirects the Yahoo Finance connection to an attacker-controlled TLS endpoint.
4. Because certificate verification is disabled, the client accepts the attacker's otherwise untrusted certificate.
5. The attacker relays, reads, or modifies financial requests and responses.
6. If authenticated requests or reusable session material traverse the affected connection, that material may also be exposed or abused according to the library's request behavior.

Impact Assessment

Exploitation compromises the confident ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the verify=False example and demonstrate the secure default, verify=True.
2. For private or enterprise certificate authorities, document passing a path to a trusted CA bundle instead of disabling validation.
3. Add a prominent warning that disabling verification permits man-in-the-middle attacks and must not be used in production.
4. If insecure verification must remain available for exceptional testing, restrict it to isolated development environments with no real credentials or sensitive data.
5. Add configuration validation that rejects verify=False in production profiles.
6. Ensure proxy examples use trusted, authenticated proxies and preserve end-to-end certificate validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (41)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation shows verify=False for HTTPS requests without any warning that this disables TLS certificate validation. That makes man-in-the-middle attacks feasible, allowing interception or tampering of financial data and potentially credentials used by the client.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation includes example code that directly embeds Yahoo account credentials as function arguments without any warning about secure secret handling. In a developer-facing skill, this can normalize unsafe practices, leading users to hardcode real credentials in scripts, notebooks, logs, or version control where they may be exposed and reused by attackers.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit example verify=False normalizes an unsafe transport setting and may be copied directly by users. In this skill's context, which retrieves remote finance data and may also involve authenticated premium access, disabling certificate verification increases the risk of traffic interception, response spoofing, and credential compromise.

Content

Scanner excerpt · references/keyword_arguments.md (reported line 351)May include surrounding context.

python

    Ticker(
        'aapl',
        verify=False
    )
    ```

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation instructs users to place Yahoo Finance Premium credentials in environment variables without any warning about secret handling, exposure in process environments, CI logs, shell history, or shared systems. While environment variables are common for configuration, presenting them without security guidance can lead to credential leakage and unsafe operational practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation includes a direct example of passing a Yahoo username and password into code without any warning about secure credential handling. This can normalize unsafe practices such as hardcoding secrets in scripts, notebooks, shell history, or version-controlled files, increasing the risk of credential leakage and account compromise.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/research.md (reported line 96)May include surrounding context.

md

=== "Data"

    |    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's
...[truncated 25 chars]

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/ticker/premium.md (reported line 658)May include surrounding context.

md

=== "Data"

    |    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's
...[truncated 25 chars]

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/ticker/premium.md (reported line 662)May include surrounding context.

md

=== "Data"

    |    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's
...[truncated 25 chars]

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/ticker/premium.md (reported line 664)May include surrounding context.

md

=== "Data"

    |    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/research.md (reported line 96)May include surrounding context.

md

=== "Data"

    |    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/research.md (reported line 99)May include surrounding context.

md

|    | Report Date              | Report type    | Report title                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Tickers   | Sector                 | Rating     | Investment Rating   | Target Price   | Earnings Estimates   |
    |---:|:-------------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:-----------------------|:-----------|:--------------------|:---------------|:---------------------|
    |  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's second-largest 
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/research.md (reported line 101)May include surrounding context.

md

|  0 | 2020-07-31T00:00:00.000Z | Analyst Report | CME Group is a futures and derivatives exchange and clearing company. It operates exchanges such as the Chicago Mercantile Exchange (CME), Chicago Board of Trade (CBOT), New York Mercantile Exchange (NYMEX), Commodity Exchange (COMEX) and the Kansas City Board of Trade (KCBT). In addition, CME offers a range of market data and information services. CME shares are a component of the S&P 500.                                                                        | ['CME']   | ['Financial Services'] | Maintained | Bullish             | Decreased      | Decreased            |
    |  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's second-largest electronic payments network, providing processing services and payment product platforms, including credit, debit, ATM, prepaid and commercial payments under the Mastercard, Maestro, and Cirrus brands. Mastercard went public in 2006 and is a member of the S&P 500.                                                                                                                                                          | ['MA']    | ['Financial Services'] | Maintained | Bullish             | Increased      | Decreased            |
    |  2 | 2020-07-31T00:00:00.000Z | Analyst Report | Blackstone Group is one of the world's leading managers of alternative assets, including private equity, real estate, hedge funds, credit-oriented funds, and closed-end mutual funds. In recent years, Blackstone has rapidly grown its fee-earning assets under management, and its assets are relatively well balanced among private equity, real estate, hedge funds, and credit. The company converted from a publicly traded partnership to a corporation on July 1, 2019. | ['BX']    | ['Financial Services'] | Maintained | Bullish             | Maintained     | Decreased            |
    |  3 | 2020-07-31T00:00:00.000Z | Analyst Report | Northrop Grumman is a leading global defense co
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/research.md (reported line 102)May include surrounding context.

md

|  1 | 2020-07-31T00:00:00.000Z | Analyst Report | Mastercard operates the world's second-largest electronic payments network, providing processing services and payment product platforms, including credit, debit, ATM, prepaid and commercial payments under the Mastercard, Maestro, and Cirrus brands. Mastercard went public in 2006 and is a member of the S&P 500.                                                                                                                                                          | ['MA']    | ['Financial Services'] | Maintained | Bullish             | Increased      | Decreased            |
    |  2 | 2020-07-31T00:00:00.000Z | Analyst Report | Blackstone Group is one of the world's leading managers of alternative assets, including private equity, real estate, hedge funds, credit-oriented funds, and closed-end mutual funds. In recent years, Blackstone has rapidly grown its fee-earning assets under management, and its assets are relatively well balanced among private equity, real estate, hedge funds, and credit. The company converted from a publicly traded partnership to a corporation on July 1, 2019. | ['BX']    | ['Financial Services'] | Maintained | Bullish             | Maintained     | Decreased            |
    |  3 | 2020-07-31T00:00:00.000Z | Analyst Report | Northrop Grumman is a leading global defense contractor, providing systems integration, defense electronics, information technology, and advanced aircraft and space technology. The shares are a component of the S&P 500. The company has 90,000 employees.                                                                                                                                                                                                                    | ['NOC']   | ['Industrials']        | Maintained | Bullish             | Maintained     | Increased            |
    |  4 | 2020-07-31T00:00:00.000Z | Analyst Report | Starbucks is a leading retailer of fresh-brewed
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/research.md (reported line 181)May include surrounding context.

md

=== "Data"

    |    | Idea Date                | Term       | Ticker   | Rating   |   Price Target |   Rate of Return | ID                              | Image URL                                                    | Company Name                  |   Price Timestamp |   Current Price | Title                                                                             | Highlights   | Description                                                                                                                                                                                                                                               |
    |---:|:-------------------------|:-----------|:---------|:---------|---------------:|-----------------:|:--------------------------------|:-------------------------------------------------------------|:------------------------------|------------------:|----------------:|:----------------------------------------------------------------------------------|:-------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
    |  0 | 2020-07-30T00:00:00.000Z | Short term | BHLB     | Sell     |           8.3  |        -0.177134 | tc_USvyP6AAPGJwApgABAACAAAD6CIg | https://s.yimg.com/uc/fin/img/bearish-continuation-wedge.svg | Berkshire Hills Bancorp, Inc. |     1596225965000 |            9.96 | Berkshire Hills Bancorp, Inc. - BHLB forms a Continuation Wedge (Bearish) pattern |              | ['This stock has formed a pattern called Continuation Wedge (Bearish), providing a target price for the short-term in the range of 8.10 to 8.50.', 'The price recently crossed below its moving average signaling a new downtrend has been established.'] |
    |  1 | 2020-07-30T00:00:00.000Z | Short term | FISV     | Buy      |         107.82 |         0.070492 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/ticker/historical.md (reported line 15)May include surrounding context.

md

|:-----------|:-----------------------------------------|:-----------------------------|:----------|:-----------|:--------------------------------------------------------------------------------------|
    | period     | Length of time                           | `str`                        | `ytd`     | optional   | `['1d', '5d', '7d', '60d', '1mo', '3mo', '6mo', '1y', '2y', '5y', '10y', 'ytd', 'max']` |
    | interval   | Time between data points                 | `str`                        | `1d`        | optional   | `['1m', '2m', '5m', '15m', '30m', '60m', '90m', '1h', '1d', '5d', '1wk', '1mo', '3mo']` |
    | start      | Specific starting date to pull data from | `str` or `datetime.datetime` |           | optional   | If a string is passed, use the format `YYYY-MM-DD`                                                                                      |
    | end      | Specific ending date                     | `str` or `datetime.datetime` |           | optional   | If a string is passed, use the format `YYYY-MM-DD`
    | adj_timezone      | Adjust datetime to the specific symbol's timezone                     | `bool` | `True`       | optional   | `True`<br>`False`
    | adj_ohlc      | Calculates an adjusted open, high, low and close prices according to split and dividend information             | `bool` | `False`       | optional   | `True`<br>`False`

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/ticker/miscellaneous.md (reported line 19)May include surrounding context.

md

=== "Data"

    |    | date                |   significance | headline                                                                                                      | parentTopics       |
    |---:|:--------------------|---------------:|:--------------------------------------------------------------------------------------------------------------|:-------------------|
    |  0 | 2012-03-19 00:00:00 |              1 | Apple Inc. Announces Plans To Initiate Dividend And Share Repurchase Program                                  | Performance        |
    |  1 | 2012-10-25 00:00:00 |              3 | Apple Inc Declares Cash Dividend                                                                              | Performance        |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/ticker/modules.md (reported line 2331)May include surrounding context.

md

=== "Data"

    |             | date       | epochDate           | type   | title                                                                                       | edgarUrl                                                                                                    |   maxAge |
    |:------------|:-----------|:--------------------|:-------|:--------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------|---------:|
    | ('aapl', 0) | 2020-05-11 | 2020-05-11 14:32:39 | 8-K    | Disclosing Other Events, Financial Statements and Exhibits                                  | https://yahoo.brand.edgar-online.com/DisplayFiling.aspx?TabIndex=2&dcn=0001193125-20-139112&nav=1&src=Yahoo |        1 |
    | ('aapl', 1) | 2020-05-01 | 2020-05-01 04:45:45 | 10-Q   | Quarterly Report                                                                            | https://yahoo.brand.edgar-online.com/DisplayFiling.aspx?TabIndex=2&dcn=0000320193-20-000052&nav=1&src=Yahoo |        1 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/ticker/modules.md (reported line 2331)May include surrounding context.

md

=== "Data"

    |             | date       | epochDate           | type   | title                                                                                       | edgarUrl                                                                                                    |   maxAge |
    |:------------|:-----------|:--------------------|:-------|:--------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------|---------:|
    | ('aapl', 0) | 2020-05-11 | 2020-05-11 14:32:39 | 8-K    | Disclosing Other Events, Financial Statements and Exhibits                                  | https://yahoo.brand.edgar-online.com/DisplayFiling.aspx?TabIndex=2&dcn=0001193125-20-139112&nav=1&src=Yahoo |        1 |
    | ('aapl', 1) | 2020-05-01 | 2020-05-01 04:45:45 | 10-Q   | Quarterly Report                                                                            | https://yahoo.brand.edgar-online.com/DisplayFiling.aspx?TabIndex=2&dcn=0000320193-20-000052&nav=1&src=Yahoo |        1 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation shows credential parameters inline in example code (username and password) without any warning or safer pattern. Even though the values are placeholders, this normalizes hard-coding secrets into source files, notebooks, and chat transcripts, which can lead users to expose real Yahoo account credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This example repeats the unsafe pattern of embedding authentication fields directly in sample code with no guidance on secret handling. Users commonly copy documentation verbatim, so this increases the chance of credential leakage into repositories, terminals, or notebooks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The income statement example includes inline username/password values and lacks a warning about handling sensitive authentication data. In a finance-related skill, users may be especially likely to run examples in shared analysis environments, raising the risk of accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The valuation measures example encourages passing secrets directly as literals into code, again without any user-facing safety guidance. This is a documentation-induced secret-handling weakness rather than an implementation bug, but it can still materially contribute to credential compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This example repeats hard-coded credential fields in a general-purpose financial data call, reinforcing unsafe usage patterns across the skill. Because the method aggregates broad data access, users may embed such examples in production scripts where secret leakage becomes more consequential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The specific financial data example contains direct credential parameters without cautionary text, which can lead users to replicate insecure secret storage practices. Repetition across many examples increases the likelihood that readers perceive hard-coded credentials as the recommended approach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Company 360 example embeds credentials inline for a property access call, again with no disclosure of the risks of exposing account data. Since this skill is documentation for a library, unsafe examples are a real supply-chain style documentation risk to downstream users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.