Security audit
Security checks for vulnerabilities and agentic risk
This skill is not obviously malicious, but it overstates market-data capabilities in a trading context by presenting simple local keyword scoring as broader news and social sentiment analysis.
Review this skill carefully before installing. It does not show evidence of malware or system-level abuse, but its financial outputs may look more authoritative than they are. Treat results as a simple keyword-based text check, not current market sentiment, unless the publisher revises the skill to disclose sources, freshness, limitations, and actual data collection behavior.
The skill promises to scan external news and social sources for ticker-specific market sentiment, but the described implementation does not actually perform those actions and instead appears to rely on local or simulated analysis. In a trading context, this can mislead users into making financial decisions based on fabricated or incomplete inputs while believing the output reflects real market data.
The invocation guidance is broad enough that the skill may trigger in many trade-analysis or portfolio-review situations without clear user intent or prerequisites. In a financial decision-support context, ambiguous auto-invocation increases the chance that users receive speculative sentiment output at inappropriate times and may overweight it in trading decisions.
The script presents its output as including 'Simulated social signals' and market sentiment analysis, but it only performs a simple keyword count on the directly supplied text. In a trading-oriented skill, this is dangerous because it can mislead users or downstream agents into believing the result reflects broader news/social sentiment, causing poor financial decisions based on fabricated analytical depth.
No suspicious patterns detected.
