Financial Data Analyzer Lite

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward stock-analysis helper that asks the agent to use yfinance for public market data, with no hidden execution, persistence, or credential access in the artifact.

Before installing, consider using a virtual environment and pinning `yfinance` and its dependencies. The skill fetches public market data and links to a paid full version, but the reviewed artifact does not show credential use, local data collection, persistence, or destructive actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–33
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet

markdown

## Requirements

- Python 3.8+
- yfinance library (`pip install yfinance`)

Technical Analysis

The skill instructs users to install yfinance without specifying an audited version or requiring package-integrity verification. Consequently, the installed artifact and its transitive dependencies can change independently of the reviewed skill.

Although the project does not itself contain malicious code, an unpinned installation command creates supply-chain exposure. If the package distribution, package-index account, selected release, or a transitive dependency is compromised, installation or later import may execute attacker-controlled code with the privileges of the user running Python or pip. Unreviewed upstream changes may also alter network behavior, data handling, or financial-analysis results.

Attack Path

1. A user follows the documented pip install yfinance instruction.
2. pip resolves the current package release and its transitive dependencies from the configured package index.
3. A compromised or unexpectedly modified release is selected because no exact version or integrity hash is enforced.
4. The package and dependencies are downloaded and installed.
5. Attacker-controlled installation or runtime code executes when supported by the selected distribution or when the dependency is imported.

Impact Assessment

Successful exploitation could execute code with the permissions of the account performing installation or running the analysis. The resulting scope may include access to that account's readable files, environment variables, network connectivity, and writable project resources. This instruction does not independently grant administrative privileges, persistence, or access beyond the invoking user's ex ...[truncated 19 chars]

Remediation

View remediation

Remediation Suggestions

• Pin yfinance to an exact, reviewed version rather than installing the latest available release.
• Maintain a reviewed lock file that fixes all transitive dependency versions.
• Record and enforce cryptographic hashes using a command such as pip install --require-hashes -r requirements.txt.
• Retrieve packages only from an explicitly approved index over authenticated TLS.
• Review dependency updates before changing pinned versions and use automated vulnerability and provenance checks.
• Perform installation in an isolated virtual environment or container under a non-privileged account.
• Separate dependency installation from normal skill execution so invoking stock analysis cannot silently alter the environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep