FireAnt Stock Price Checker

• Outcome: Review
• Latest audit: May 28, 2026 at 4:39 AM UTC
• Version:
  1.1.0

Overview

This stock-checking skill appears purpose-aligned, but it should be reviewed because its script runs a hard-coded local browser executable instead of a declared, verified dependency.

Review before installing. Verify or replace the hard-coded agent-browser path in scripts/check_stock.py, install agent-browser only from a trusted source, and run the skill in an isolated environment first. Do not use it if you cannot verify which local binary the script will execute.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands (`scripts/check_stock.py ...`) and depends on external tooling (`agent-browser`) but declares no permissions. This creates a mismatch between the skill's documented capabilities and its security model, which can lead to unintended command execution in environments that rely on declared permissions for policy enforcement and review.

VirusTotal

64/64 vendors flagged this skill as clean.