Yahoo Finance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

The skill is a Yahoo Finance CLI guide, but it asks users to run unverified remote installer commands and the actual CLI script it describes is not included.

Review this skill carefully before installing. Prefer installing uv through a trusted package manager or verified release instead of copying the remote execution commands, and do not run the global symlink or first-run dependency steps until the missing yf script and its exact dependencies are available for review.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27

Finding

Unverified Remote Shell Script Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The installation command downloads a mutable script from an external URL and pipes the response directly into a shell. The payload is not pinned to a reviewed version, saved for inspection, or verified using a cryptographic signature or checksum.

Although the domain is presented as the official source for uv, this pattern makes the code executed on the user's machine dependent on the response returned at installation time. Compromise of the upstream server, release infrastructure, domain, or trusted delivery path could therefore result in arbitrary commands being executed.

Installing a package manager may be necessary for the documented workflow, but immediate pipe-to-shell execution exceeds the minimum privilege and trust required to provide installation instructions. Safer package-manager and verified-release alternatives are available.

Attack Path

1. An attacker compromises the remote installer, its hosting infrastructure, or another trusted component of the delivery path.
2. The attacker modifies the response from https://astral.sh/uv/install.sh to include malicious shell commands.
3. A user follows the documented installation command.
4. curl retrieves the attacker-controlled response.
5. The pipe sends the response directly to sh without inspection or integrity verification.
6. The payload executes with all privileges available to the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the user's account. The payload could read or modify user-accessible files, access environment variables and credentials available to the process, install additional software, or make further network ...[truncated 106 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the pipe-to-shell installation command.
• Prefer installation through a trusted operating-system package manager, such as the documented Homebrew or pip alternatives, with an exact reviewed version.
• If direct download is required, download a versioned release artifact to disk rather than executing a mutable URL response.
• Publish and verify a cryptographic signature or checksum obtained through an authenticated, independent channel.
• Instruct users to inspect the downloaded installer before execution.
• Run installation without administrative privileges unless a specific operation demonstrably requires them.
• Document the precise version, expected checksum, source repository, and update process.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:37

Finding

Remote PowerShell Execution with Execution-Policy Bypass

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 37
Vulnerability Type: Remote payload retrieval and immediate PowerShell execution
Risk Level: High

Vulnerable Code:

powershell

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Technical Analysis

This command retrieves a mutable PowerShell script using Invoke-RestMethod and immediately executes the response using Invoke-Expression. No version pinning, signature validation, checksum verification, or manual review is required.

The command additionally starts PowerShell with -ExecutionPolicy ByPass, explicitly avoiding the configured execution-policy check for this process. Execution policy is not a complete security boundary, but bypassing it removes a defense-in-depth control and increases the danger of executing an unverified network response.

The behavior is not necessary at this privilege level for the declared Yahoo Finance functionality. A package manager or a separately downloaded and authenticated installer can provide the dependency without direct remote evaluation.

Attack Path

1. An attacker compromises the remote installer, hosting infrastructure, or another trusted delivery component.
2. The remote endpoint returns attacker-controlled PowerShell commands.
3. A user copies the documented installation command.
4. Invoke-RestMethod retrieves the modified payload.
5. Invoke-Expression evaluates the response as PowerShell code.
6. The process-level execution-policy bypass prevents the configured policy from blocking the script.
7. The malicious commands execute with the invoking user's privileges.

Impact Assessment

Successful exploitation enables arbitrary PowerShell execution in the user's security context. This can expose user-accessible files, environment variables, browser or developer credentials available to the process, and network resources accessible by the accoun ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the Invoke-RestMethod | Invoke-Expression pattern.
• Do not instruct users to bypass PowerShell execution policy.
• Prefer a trusted package manager with an exact, reviewed package version.
• If a standalone installer is necessary, download a versioned artifact, verify its Authenticode signature and published cryptographic hash, and only then execute it.
• Display the expected publisher identity and checksum in the documentation.
• Use a non-elevated PowerShell session and request additional privileges only for narrowly defined operations that require them.
• Provide an auditable offline installation procedure.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned and Automatically Installed Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–61
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install uv

text

First run will install dependencies (yfinance, rich) to uv's cache. Subsequent runs are instant.

Technical Analysis

The documentation installs uv without an exact version or integrity hash and states that the first run automatically installs yfinance and rich. No versions, lockfile, package-index restrictions, signatures, or hashes are supplied.

As a result, the actual components installed can change after review. Python package installation may execute package build or installation logic, while imported dependencies execute in the CLI process. A compromised upstream release, package registry account, or dependency resolution path could therefore introduce attacker-controlled code or silently alter financial results.

The available project contains only SKILL.md; the referenced yf script and its PEP 723 metadata are absent. Consequently, the dependency constraints, package sources, and first-run behavior cannot be independently verified from the audited artifact.

Attack Path

1. An attacker compromises a relevant package release, maintainer account, registry distribution path, or transitive dependency.
2. Because no exact reviewed versions or hashes are specified, dependency resolution selects the compromised or unexpectedly changed release.
3. A user runs pip install uv or invokes the proposed CLI for the first time.
4. The installer downloads and installs the selected package and dependencies.
5. Malicious installation logic or imported runtime code executes with the user's privileges.
6. The compromised dependency can access data available to the process or manipulate displayed financial information.

Impact Assessment

The maximum scope is arbitrary code execution un ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

• Pin uv, yfinance, rich, and all transitive dependencies to exact reviewed versions.
• Commit the referenced yf implementation and its dependency metadata so the behavior can be audited.
• Generate and commit a lockfile containing cryptographic hashes for every resolved artifact.
• Require hash verification during installation and reject artifacts that do not match the lockfile.
• Explicitly configure the approved package index and prevent fallback to unexpected indexes or package sources.
• Prefer reviewed binary wheels where appropriate and reject unexpected source distributions or build substitutions.
• Add automated dependency vulnerability and provenance checks to the release process.
• Review and deliberately approve dependency updates rather than resolving unrestricted current releases on first run.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs users to install uv via curl ... | sh and PowerShell irm ... | iex, which executes remote code directly in the shell without prior verification. This creates a real supply-chain and remote code execution risk if the install endpoint, network path, or fetched script is compromised; the skill context increases risk because these are explicit setup steps likely to be copied and run by users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.