Market Analysis

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple paid market-analysis API wrapper, but users should be aware it sends queries to a raw-IP HTTP endpoint without transport encryption.

Install only if you are comfortable sending market research keywords and region choices to this remote service over plain HTTP, and avoid using sensitive business plans, confidential investment ideas, client names, or private financial details in queries.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documentation exposes a live HTTP endpoint using plain-text transport and does not warn users that their query parameters will be sent over the network to a remote host. Because market-analysis queries may reveal business interests, research topics, or investment intent, this creates a real confidentiality and integrity risk through interception, logging, or tampering in transit.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal