stock-tracker

• Outcome: Review
• Latest audit: Jul 1, 2026 · 2:20 AM UTC
• Version: 2.2.0

Overview

The skill appears purpose-aligned, but it handles live account cookies, sends announcement data to configurable external services, and includes automatic scheduling behavior that users should review first.

Review before installing or running setup. Treat cookie.txt and .env as secrets, do not commit them, restrict file permissions, confirm any cron entries manually, bind the dashboard to localhost only unless you intend network exposure, and use the LLM/webhook features only if sending announcement data to those endpoints is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities to read/write local files, access environment-based secrets, and make network requests, yet it declares no permissions. This creates a transparency and consent gap: an agent or user may invoke the skill without understanding it can handle cookies, .env secrets, local files, and external HTTP services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The documented behavior expands beyond the stated purpose by including alternate data sources, cookie refresh automation, webhook notifications, scheduling support, and CSV export. This mismatch can mislead users about the true operational scope, especially where browser automation, outbound notifications, or persistence are involved.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly instructs users to copy a live browser session cookie into a local file, but does not warn that this cookie is equivalent to an authenticated session credential and can enable account access if exposed. In the context of an agent skill that automates fetching data and may run on shared systems, encouraging persistent storage of session cookies materially increases the risk of credential leakage or unauthorized reuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README describes optional LLM configuration and downstream classification/summarization, but does not clearly disclose that announcement text and related metadata may be transmitted to an external third-party API endpoint. This creates a data handling and privacy risk because users may unknowingly send proprietary watchlists, scraped content, or sensitive market-monitoring context outside their environment.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The invocation examples use broad natural-language phrases like asking the agent to 'help set up' reminders or 'open the dashboard,' which could match casual user requests unintentionally. In an agent environment, overly broad triggers increase the risk of accidental execution of network activity, scheduling, or local service startup without clear confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup flow instructs users to extract and store a live authenticated browser cookie in cookie.txt, but it does not prominently warn that this cookie is a sensitive credential equivalent to session access. If mishandled, exposed, or overwritten by automation, an attacker or another process could reuse it to access the user's account context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The LLM configuration section encourages sending announcement content to an external API but does not warn users that fetched content, metadata, or derived summaries may leave the local environment. This can create unintended data disclosure, especially if announcements, watchlists, or account-linked context are sensitive in the user's workflow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script transmits full announcement content to an external LLM service via HTTP API, and the code shows no consent gate, data-classification check, minimization, or explicit disclosure before export. Even if announcements are public, this still creates a data-governance and supply-chain risk because sensitive or misclassified content could be sent to a third-party model provider without policy enforcement.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends announcement titles, stock names, and market metadata to a third-party LLM service over the network. Even if this data is not obviously secret, it is still external data transmission without any consent flow, minimization, or documented privacy boundary in this module, which can create confidentiality, compliance, or data-governance issues in enterprise use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs a bulk destructive update by clearing all existing classification fields before reprocessing, and it does so without any interactive confirmation, backup step, or transactional rollback strategy. If the LLM run fails partway, the process is interrupted, or classifications are poor, the dataset can be left partially blank or inconsistent, causing avoidable integrity loss.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends announcement titles and stock names to an external LLM service for classification, but there is no user-facing disclosure, consent, or data-handling boundary visible in the workflow. Even if the fields are not highly sensitive, this creates an unintended data exfiltration path to a third party and may violate operator expectations, policy, or compliance requirements.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script creates a .env file intended to hold an API key but provides no warning about file permissions, secret handling, or avoiding accidental commits. In a setup script, this can lead users to store credentials insecurely in the project directory where they may be exposed via source control, backups, or multi-user systems.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically writes cron entries to the user's crontab without explicit consent at the moment of modification. This is risky because it establishes persistent scheduled execution, which can surprise users, create unintended network activity, and make later malicious or buggy changes run automatically.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: Untrusted announcement body text is inserted directly into the LLM prompt, allowing prompt injection inside the document to compete with or override the summarization instructions. Because the model output is then parsed and stored in the database and optionally emitted to stdout for agent forwarding, a malicious announcement could manipulate summaries, produce malformed output, or inject misleading downstream content.

External Transmission

Medium

• Category: Data Exfiltration

Content

for attempt in range(retries + 1):
        try:
            resp: requests.Response = requests.post(
                f"{base_url}/chat/completions",
                headers={
                    "Authorization": f"Bearer {api_key}",

• Confidence: 89% confidence
• Finding: requests.post( f"{base_url}/chat/completions", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json

External Transmission

Medium

• Category: Data Exfiltration

Content

for attempt in range(self.retries + 1):
            try:
                resp: requests.Response = requests.post(
                    self._chat_url,
                    headers=self._headers,
                    json={

• Confidence: 90% confidence
• Finding: requests.post( self._chat_url, headers=self._headers, json=

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
flask>=3.0.0
pdfplumber>=0.10.0

• Confidence: 97% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
flask>=3.0.0
pdfplumber>=0.10.0

• Confidence: 97% confidence
• Finding: flask>=3.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
flask>=3.0.0
pdfplumber>=0.10.0

• Confidence: 96% confidence
• Finding: pdfplumber>=0.10.0

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: flask==3.0.0 — 1 advisory(ies): CVE-2026-27205 (Flask session does not add `Vary: Cookie` header when accessed in some ways)

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: flask==3.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:133

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/test_config_manager.py:166