financial-market-data

• Outcome: Review
• Latest audit: May 29, 2026 at 9:31 PM UTC
• Version:
  1.0.2

Overview

This financial market data skill is mostly purpose-aligned, but it ships with and uses a concrete third-party API key, which needs review before installation.

Install only if you are comfortable with live market-data queries going to external providers. Before use, remove or rotate the bundled Eastmoney key and configure your own key locally, preferably through an environment variable or secret manager.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill extensively demonstrates calls to third-party APIs and market-data providers without clearly warning users that running the examples will transmit queries, stock symbols, IP metadata, and possibly authentication tokens to external services. In an agent or automated environment, this can cause unintended data disclosure, policy violations, or unreviewed outbound network activity, especially where users assume examples are local-only.

VirusTotal

65/65 vendors flagged this skill as clean.