Security audit

Us Stock Analyst

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it analyzes US stocks through AIsa APIs, with some normal but important privacy and report-file risks to understand.

Install only if you are comfortable sending stock tickers, watchlists, research queries, and generated analysis context to AIsa and its model providers. Prefer AISA_API_KEY over --api-key, review generated reports before relying on them for financial decisions, and choose output filenames carefully because the script writes JSON reports locally.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/stock_analyst.py:298
Finding: Indirect Prompt Injection Through Untrusted Market and Social Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/stock_analyst.py:512
Finding: API Credential Exposure Through Command-Line Arguments
Content: View full analysis
argparse.ArgumentParser: parser = argparse.ArgumentParser( description="Analyze a US stock with AIsa market, search, social, and LLM endpoints.", ) parser.add_argument("--api-key", help="Override AISA_API_KEY instead of reading from the environment.") parser.add_argument("--ticker", help="Stock ticker symbol, e.g. AAPL or NVDA.") parser.add_argument( "--depth", choices=["quick", "standard", "deep"], default="standard", help="How many data sources to query before synthesis.", ) parser.add_argument( "--models", default="gpt-4,claude-3-opus", help="Comma-separated LLM models used for summary/sentiment/valuation.", ) parser.add_argument( "--output", help="Optional JSON output path. Defaults to _analysis_.json in the cwd.", ) parser.add_argument( "--json-only", action="store_true", help="Print the final report as JSON instead of the human-readable summary.", ) return parser def resolve_runtime_inputs(args: argparse.Namespace) -> tuple[str, str, List[str], str, Optional[str], bool]: api_key = args.api_key or os.environ.get("AISA_API_KEY") ``` ### Technical Analysis The script allows a paid AIsa API credential to be supplied using the `--api-key` command-line option. Command-line arguments commonly appear in shell history, process listings, terminal-session recordings, diagnostic bundles, job-runner metadata, and monitoring systems. This exposure mechanism is unnecessary because the Skill already supports the documented `AISA_API_KEY` environment variable. The credential is not deliberately printed or written to the generated repor ...[truncated 1234 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 60% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Real-time Financial Metrics

bash
curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and demonstrates use of environment variables, network access, and report output to files, but does not declare any explicit tool scope such as permissions or allowed-tools. That weakens sandboxing and review because a host agent may permit broader capabilities than users expect, especially for a user-invocable skill that sends data to third-party APIs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages users to submit tickers, portfolio holdings, watchlists, and natural-language analysis requests, then routes that data to external financial, search, social, video, and LLM services. Because the description does not clearly warn that user-provided portfolio/watchlist data and prompts are transmitted off-platform, users may unknowingly disclose sensitive financial interests or proprietary research queries.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This skill clearly transmits user-supplied analysis targets to an external API using the bearer token in AISA_API_KEY. External transmission is expected for this skill's function, but it remains a real privacy/security concern because financial interests, research prompts, and derived watchlists may leave the local environment and be processed by a third party.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Real-time Financial Metrics

bash
curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This skill clearly transmits user-supplied analysis targets to an external API using the bearer token in AISA_API_KEY. External transmission is expected for this skill's function, but it remains a real privacy/security concern because financial interests, research prompts, and derived watchlists may leave the local environment and be processed by a third party.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Real-time Financial Metrics

bash
curl "https://api.aisa.one/apis/v1/financial/financial-metrics/snapshot?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Historical price queries send user-selected ticker interests and time windows to an external service. While routine for market-data skills, this still exposes user research activity to a third party and should be considered a genuine data-transmission risk, especially for proprietary portfolio workflows.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
Historical Stock Prices

bash
# Daily prices for last 30 days curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-01-01&end_date=2025-01-31&interval=day&interval_multiplier=1" \ -H "Authorization: Bearer $AISA_API_KEY" # 5-minute intraday data

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Intraday price requests disclose more granular user interest and timing to the external provider, potentially revealing active trading research patterns. The skill context makes this transmission expected, but not harmless, because repeated fine-grained queries can expose sensitive strategy information.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
-H "Authorization: Bearer $AISA_API_KEY"

5-minute intraday data

curl "https://api.aisa.one/apis/v1/financial/prices?ticker=AAPL&start_date=2025-02-07&end_date=2025-02-07&interval=minute&interval_multiplier=5"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: Financial statements retrieval is another external transmission channel for user-selected company analysis. The risk is contextual rather than exploit-driven: user research interests and workflow data leave the local agent boundary and are processed externally.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
Financial Statements

bash
# All statements (income, balance, cash flow) curl "https://api.aisa.one/apis/v1/financial/financial_statements/all?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: Analyst estimate lookups send user research targets to an external provider. In isolation this is ordinary, but in aggregate across portfolio workflows it can reveal investment intentions and should therefore be treated as a valid privacy/security concern.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
Analyst Estimates

bash
# EPS forecasts and ratings curl "https://api.aisa.one/apis/v1/financial/analyst/eps?ticker=AAPL&period=annual" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Insider trade lookups are sent externally and may be combined with a user's broader watchlist activity. That can expose sensitive due-diligence patterns to the service provider even if the endpoint itself is legitimate.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
Insider Trading

bash
# Track insider buy/sell activity curl "https://api.aisa.one/apis/v1/financial/insider/trades?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: Institutional ownership queries transmit the user's analysis interests to a third party. This is expected for the skill, but remains a real external data-flow risk that should be disclosed and governed by least privilege and informed consent.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
Institutional Ownership

bash
# See who owns the stock curl "https://api.aisa.one/apis/v1/financial/institutional/ownership?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: SEC filing access through the remote API continues the same external transmission pattern. The danger is not the SEC data itself, but the leakage of the user's research agenda and any correlated workflow metadata to the API operator.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
SEC Filings

bash
# Access 10-K, 10-Q, 8-K filings curl "https://api.aisa.one/apis/v1/financial/sec/filings?ticker=AAPL" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Company news queries send tickers and potentially repeated monitoring activity to an external service. In a portfolio-monitoring use case, this can reveal holdings or targets over time, making the transmission risk more significant than a one-off public lookup.
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
Company News

bash
curl "https://api.aisa.one/apis/v1/financial/news?ticker=AAPL&limit=10" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The web search endpoint accepts free-form query strings, so user prompts and research topics may be transmitted verbatim to the provider. This is more sensitive than simple ticker lookups because natural-language queries can contain proprietary strategies, portfolio context, or personal data.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
Web Search (News & Articles)

bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/web?query=AAPL+stock+analysis&max_num_results=10" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: Academic search also sends free-form research queries off-platform, potentially exposing proprietary analysis themes or sensitive text. Because the endpoint is query-driven, the privacy risk is higher than for fixed-parameter market data lookups.
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
Academic Research

bash
curl -X POST "https://api.aisa.one/apis/v1/scholar/search/scholar?query=semiconductor+industry+analysis&max_num_results=5" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: Twitter search transmits user-selected symbols and sentiment targets to a third party, potentially revealing speculative interests or active monitoring behavior. Social-sentiment enrichment increases the breadth of external sharing across services, raising cumulative privacy risk.
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
Twitter Search

bash
curl "https://api.aisa.one/apis/v1/twitter/tweet/advanced_search?query=\$AAPL&queryType=Latest" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: YouTube search sends user interests and query text to an external provider via the API aggregator. Although normal for video discovery, it expands third-party exposure and should be disclosed, especially when combined with other analysis inputs.
Content: Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.
YouTube Search (Earnings Calls, Analysis)

bash
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AAPL+earnings+call&gl=us&hl=en" \ -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: The LLM gateway forwards user prompts to external AI models, which can include portfolio holdings, investment theses, or other sensitive text. This is more dangerous than simple data fetches because prompts may be retained, logged, or used by downstream model providers, and the skill markets multi-model routing without a prominent data-sharing warning.
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
LLM Gateway (OpenAI Compatible)

bash
curl -X POST "https://api.aisa.one/v1/chat/completions" \ -H "Authorization: Bearer $AISA_API_KEY" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/stock_analyst.py (reported line 13)May include surrounding context.
python
- YouTube Content - Multi-Model LLM Analysis Base URL: https://api.aisa.one/apis/v1 LLM Base URL: https://api.aisa.one/v1 """

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/stock_analyst.py (reported line 14)May include surrounding context.
python
- YouTube Content - Multi-Model LLM Analysis Base URL: https://api.aisa.one/apis/v1 LLM Base URL: https://api.aisa.one/v1 """

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/stock_analyst.py (reported line 32)May include surrounding context.
python
- YouTube Content - Multi-Model LLM Analysis Base URL: https://api.aisa.one/apis/v1 LLM Base URL: https://api.aisa.one/v1 """

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/stock_analyst.py (reported line 33)May include surrounding context.
python
- YouTube Content - Multi-Model LLM Analysis Base URL: https://api.aisa.one/apis/v1 LLM Base URL: https://api.aisa.one/v1 """

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The YouTube search request forces locale-related parameters to US region and English language via gl="us" and hl="en". This imposes a specific language/locale choice in the skill behavior without offering the user a choice or clearly documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a market-analysis skill for data, news, sentiment, and portfolio-style workflows, but this implementation also persists full reports to disk by default. Local file output is not an obvious requirement of performing an analysis itself, especially when it happens automatically rather than as a clearly separate export feature.
Content: No source excerpt is available for this finding.

Tainted flow: 'filename' from input (line 640, user input) → open (file write)

Medium

Category: Data Flow
Confidence: 93% confidence
Finding: The output path is derived from user-controlled input (--output) and passed directly to open(..., "w"), allowing arbitrary file overwrite within the executing user's permissions. In an agent or automation context, this can be abused for path traversal or clobbering sensitive local files, which is more dangerous than in a purely interactive CLI utility.
Content: Scanner excerpt · scripts/stock_analyst.py (reported line 641)May include surrounding context.
python
print_report(report) filename = output_path or f"{ticker}_analysis_{datetime.now().strftime('%Y%m%d')}.json" with open(filename, "w") as f: json.dump(report, f, indent=2) print(f"✅ Full report saved to {filename}")

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Undeclared Tool Scope

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

5-minute intraday data

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Description-Behavior Mismatch

Tainted flow: 'filename' from input (line 640, user input) → open (file write)

Static analysis