Reddit Stonks

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.1.1

Overview

The skill appears to do what it says, but its web mode can expose an unauthenticated endpoint that spends the user's DeepSeek API credits and renders untrusted AI or market data unsafely.

Install only if you are comfortable sending Reddit and market-analysis context to DeepSeek and Yahoo Finance, and do not expose the web app publicly as documented without adding authentication, rate limits, dependency pinning, and HTML sanitization. Treat its stock picks as entertainment or research input, not financial advice.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: static/index.html:154

Finding

DOM-Based Cross-Site Scripting Through Unescaped AI and Market Data

Content

View full analysis

$1') .replace(/\n- /g, '
• ') .replace(/\n\n/g, '

') .replace(/\n/g, '
'); return html; } ``` ```javascript tbody.innerHTML = data.stocks.map(s => ` $${s.ticker} ${formatPrice(s.price)} ${formatChange(s.week_change_pct)} ${formatMCap(s.market_cap)} ${s.pe_ratio ? s.pe_ratio.toFixed(1) : 'N/A'} ${s.beta ? s.beta.toFixed(2) : 'N/A'} ${s.mentions} ${s.recommendation} `).join(''); ``` ```javascript if (data.analysis) { document.getElementById('analysis-content').innerHTML = renderMarkdown(data.analysis); document.getElementById('analysis-section').classList.remove('hidden'); document.getElementById('analysis-section').scrollIntoView({ behavior: 'smooth', block: 'center' }); } ``` ```javascript document.getElementById('euro-body').innerHTML ...[truncated 2174 chars]

Remediation

View remediation

` and verify that they are displayed only as inert text. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: app.py:130

Finding

Unauthenticated Analysis Endpoint Enables API-Credit and Resource Exhaustion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Python Dependencies Permit Non-Reproducible Supply-Chain Updates

Content

View full analysis

=2.31.0 openai>=1.0.0 yfinance>=0.2.36 python-dotenv>=1.0.0 rich>=13.0.0 ``` The installation command is documented in `SKILL.md:26` and `README.md:20,31`: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses only a lower version bound. A new and unreviewed future release therefore satisfies the requirement automatically. The project does not include a lockfile, exact transitive dependency versions, or package hashes. The package names observed in the audit are established projects rather than evident typosquats or dependency-confusion names. The weakness is nevertheless that installation is not reproducible and does not bind artifacts to reviewed versions. Python packages and their installation logic execute with the privileges of the account running `pip`. Consequently, compromise of a permitted future release, package index, account, or transitive dependency could introduce code that runs during installation or application startup. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or the package publication account. 2. The attacker publishes a newer release that remains compatible with the project's `>=` requirement. 3. A user follows the documented `pip install -r requirements.txt` command. 4. The resolver selects the compromised newer release because there is no upper bound, lockfile, or required hash. 5. Malicious installation or runtime code executes with the installing user's privileges. ### Impact Assessment The potential impact equals the privileges of the user or deployment process that installs or imports the dependency. This may include: - Reading environment variables such as `DEEPSEEK_API_KEY`. - Reading or modifying files accessible to the application account. - Makin ...[truncated 286 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: static/index.html:7

Finding

Unversioned Third-Party CDN Script Executes Without Integrity Verification

Content

View full analysis

``` The pages also retrieve a remote stylesheet: ```css @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700;800&display=swap'); ``` ### Technical Analysis The application loads an unversioned Tailwind CDN script at runtime. No Subresource Integrity hash is supplied, and the response is executable JavaScript. As a result, the code executed by visitors can change after the Skill package has been reviewed, without any modification to the repository. If the CDN, DNS path, publication process, or served resource is compromised, malicious JavaScript would execute in the application's browser origin. The Google Fonts import is also a third-party request and discloses visitor network metadata to that provider, although it is not itself loaded as JavaScript. ### Attack Path 1. An attacker compromises the CDN service, its deployment process, or another part of the resource delivery path. 2. The response for `https://cdn.tailwindcss.com` is changed to contain malicious JavaScript. 3. A user opens the application page. 4. The browser downloads and executes the changed script because the page has no integrity pin and no restrictive Content Security Policy preventing it. 5. The script operates with the same browser-origin access as the legitimate frontend. ### Impact Assessment A compromised CDN response could: - Read and alter all DOM content in the application. - Manipulate displayed stock analysis and recommendations. - Trigger same-origin analysis requests. - Exfiltrate browser-visible data. - Redirect visitors or present phishing interfaces. This issue affects browser clients rather than directly granting operating-system access to the server. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

bash

pip install -r requirements.txt
cp .env.example .env   # add DEEPSEEK_API_KEY
python3 stonks.py       # standard run
python3 stonks.py -e    # with European equivalents
python3 stonks.py -p 10 # fast (fewer posts)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

pip install -r requirements.txt
cp .env.example .env   # add DEEPSEEK_API_KEY
python3 stonks.py       # standard run
python3 stonks.py -e    # with European equivalents
python3 stonks.py -p 10 # fast (fewer posts)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · stonks.py (reported line 253)May include surrounding context.

python

```bash
pip install -r requirements.txt
cp .env.example .env   # add DEEPSEEK_API_KEY
python3 stonks.py       # standard run
python3 stonks.py -e    # with European equivalents
python3 stonks.py -p 10 # fast (fewer posts)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

bash

pip install -r requirements.txt
cp .env.example .env
python3 -m uvicorn app:app --host 0.0.0.0 --port 8080

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A second independent mismatch report similarly indicates the skill is presented as a Reddit-scraping, AI stock-picking web app while observed behavior is much narrower. Repeated inconsistencies increase the risk of deceptive packaging, accidental overtrust, and unsafe invocation in contexts involving financial recommendations and external API credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independent mismatch report similarly indicates the skill is presented as a Reddit-scraping, AI stock-picking web app while observed behavior is much narrower. Repeated inconsistencies increase the risk of deceptive packaging, accidental overtrust, and unsafe invocation in contexts involving financial recommendations and external API credentials.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 49)May include surrounding context.

html

<main class="max-w-6xl mx-auto px-6 py-8 space-y-8">

  <!-- Controls -->
  <div class="glass rounded-2xl p-6 slide-in">
    <div class="flex flex-wrap items-end gap-6">
      <div class="flex-1 min-w-[200px]">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · static/index.html (reported line 49)May include surrounding context.

html

<main class="max-w-6xl mx-auto px-6 py-8 space-y-8">

  <!-- Controls -->
  <div class="glass rounded-2xl p-6 slide-in">
    <div class="flex flex-wrap items-end gap-6">
      <div class="flex-1 min-w-[200px]">

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises network access, environment variable use, and file-writing related setup/operation but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can lead to overbroad execution authority and make it harder to constrain what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very broad investing-related requests such as 'what should I buy' and 'best stock this week,' which can cause the skill to be invoked in contexts beyond its safe or intended operating boundaries. Overbroad activation is especially risky here because the skill makes financial-selection claims and may use external data and AI analysis, increasing the chance of inappropriate autonomous recommendations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code sends the assembled analysis context to the Deepseek chat completion API, and that context includes scraped Reddit post counts and stock-related derived data. There is no confirmation prompt, user-facing notice, or explanatory comment/docstring near this network transmission to inform users that collected data is being sent to a third-party AI service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This HTML/JS file initiates a request to /api/analyze and presents status text such as "Scraping Reddit...", but the user-facing control provides no warning that clicking Analyze will start network activity and process external data. For code files, network operations that may transmit user or system data should have some visible disclosure, prompt, or explanatory text, and none appears near the action control or request logic.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · app.py (reported line 21)May include surrounding context.

python

load_dotenv()

DEEPSEEK_API_KEY = os.getenv("DEEPSEEK_API_KEY")
DEEPSEEK_BASE_URL = "https://api.deepseek.com/v1"

console = Console()
client = OpenAI(api_key=DEEPSEEK_API_KEY, base_url=DEEPSEEK_BASE_URL)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · stonks.py (reported line 21)May include surrounding context.

python

load_dotenv()

DEEPSEEK_API_KEY = os.getenv("DEEPSEEK_API_KEY")
DEEPSEEK_BASE_URL = "https://api.deepseek.com/v1"

console = Console()
client = OpenAI(api_key=DEEPSEEK_API_KEY, base_url=DEEPSEEK_BASE_URL)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends aggregated Reddit-derived content and stock/market context to a third-party AI provider without any explicit user-facing notice or consent at the time of transmission. Even if the data is public, forwarding user-request-related analysis context to an external service creates a privacy and data-governance risk, especially in an agent setting where users may not expect third-party processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This HTML/JavaScript file triggers a network request to /api/analyze via EventSource when the user clicks Analyze, but the UI does not disclose that the selected settings and resulting analysis request are transmitted to a server. For a skill that performs external analysis and scraping, a brief user-facing notice about backend processing would improve transparency.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which allows any newer release to be installed and makes builds non-reproducible. This increases supply-chain risk because a future compromised or incompatible version of requests could be pulled in without review, and the separate advisory data shows requests has had multiple security issues historically.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
openai>=1.0.0
yfinance>=0.2.36
python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

requests has multiple known advisories, but the manifest does not pin a version, so it is impossible to verify whether deployment will use a fixed or vulnerable release. In a skill that scrapes external sites and likely makes arbitrary HTTP requests, a vulnerable requests version could expose credentials, mishandle redirects, or weaken transport security depending on the code path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using openai>=1.0.0 permits unbounded upgrades, so the installed package may vary over time and across environments. That creates a supply-chain and stability risk even if no specific advisory is cited here, because a malicious or breaking upstream release could be introduced automatically.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
openai>=1.0.0
yfinance>=0.2.36
python-dotenv>=1.0.0
rich>=13.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The yfinance dependency is not pinned to an exact version, making dependency resolution non-deterministic. In a skill that consumes external market data, silently changing library behavior or pulling a compromised release could affect integrity and availability of analysis results.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
openai>=1.0.0
yfinance>=0.2.36
python-dotenv>=1.0.0
rich>=13.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

python-dotenv is specified with a minimum version only, allowing unreviewed future versions to be installed. Because this package interacts with environment configuration, an unsafe release could affect secret handling or file operations, making version pinning especially important.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
openai>=1.0.0
yfinance>=0.2.36
python-dotenv>=1.0.0
rich>=13.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

python-dotenv has known advisories and the version is not pinned, so the deployed package may still include vulnerable behavior. Because dotenv libraries can read and write environment-related files, issues such as symlink-following or unintended file overwrite are more sensitive when the skill may run with access to secrets or writable project files.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

rich>=13.0.0 is an unpinned dependency, which weakens reproducibility and opens a general supply-chain risk window. While the direct security impact is typically limited for a console formatting library, automatic upgrades can still introduce malicious or breaking code.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

openai>=1.0.0
yfinance>=0.2.36
python-dotenv>=1.0.0
rich>=13.0.0

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The code queries Yahoo Finance via yfinance when creating a ticker object and reading stock.info, which transmits requested tickers to an external service. While there are print statements for progress later in the file, there is no explicit disclosure here that the skill performs network access to a third-party provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

fetch_stock_data issues external requests through yfinance for each ticker and retrieves both metadata and price history. The visible prints only announce fetching progress and results, but do not warn that user-supplied ticker symbols are sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: app.py:23

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: stonks.py:24