Modular Market Brief

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:10 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed market-brief helper that uses optional public market-data scripts and does not show hidden persistence, credential access, destructive behavior, or exfiltration.

Before installing, treat the market data as informational rather than trading advice, review any generated BUY/SELL/WAIT labels as simple patterns, and consider pinning or reviewing Python dependency versions if you use the optional scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–46
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

python3 -m venv ~/.venvs/market-brief
~/.venvs/market-brief/bin/pip install -U pip
~/.venvs/market-brief/bin/pip install yfinance pandas numpy

Technical Analysis

The documented installation procedure upgrades pip and installs yfinance, pandas, and numpy without fixed versions, package hashes, or a reviewed lockfile. Package resolution therefore depends on the mutable state of the configured Python package index at installation time.

An unpinned installation does not establish that any current package is malicious. However, it creates an avoidable supply-chain exposure: a compromised package release, compromised maintainer account, malicious transitive dependency, dependency-confusion condition caused by index configuration, or unexpectedly incompatible future release could be installed without further project review.

Python packages may execute code during installation, and installed packages execute code when imported by the bundled scripts. Consequently, dependency integrity is part of the skill's effective security boundary.

Attack Path

1. A user follows the setup instructions in SKILL.md.
2. pip is upgraded to the latest version available from the configured package index.
3. pip resolves the latest available releases of yfinance, pandas, numpy, and their transitive dependencies.
4. An attacker compromises a dependency release, maintainer account, package-index path, or applicable dependency-resolution source.
5. The affected package is downloaded and installed because no reviewed version or cryptographic hash is enforced.
6. Malicious code may execute during installation or later when price_tape.py imports the affected dependency.

Impact Assessment

Malicious dependency code would gen ...[truncated 625 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unconstrained package installation with a reviewed lockfile containing exact versions for direct and transitive dependencies.
2. Generate and verify cryptographic hashes, then install with hash enforcement, for example:

   bash

   ~/.venvs/market-brief/bin/pip install --require-hashes -r requirements.lock
   

3. Pin the packaging toolchain rather than automatically upgrading pip to an unspecified latest release.
4. Generate the lockfile through a reproducible dependency-management process such as pip-tools, and review dependency updates before merging them.
5. Configure an explicitly trusted package index and disable unintended fallback indexes where dependency confusion is a concern.
6. Run dependency vulnerability and provenance checks in CI, and periodically regenerate pins to incorporate reviewed security updates.
7. Execute market-data scripts under a least-privileged account or sandbox when practical; a virtual environment alone is not a security boundary.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad market-reporting skill capable of assembling configurable AM/PM reports across global assets and multiple report sections. The supplied code chunk instead implements a single-purpose data retrieval utility for Yahoo Finance top movers. While top movers blocks are one component mentioned in the description, this code does not generate reports, summaries, dashboards, sector trend tables, or cross-asset analysis. It also relies on a Yahoo screener source explicitly noted as typically US-centric, which conflicts with the claim of being region-agnostic and broadly global. Therefore the actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad market-report generation skill for daily briefs and configurable cross-asset dashboards. The supplied code is much narrower: it is a minimal price tape utility for user-provided tickers, focused on fetching historical prices and calculating technical indicators. It does not assemble modular market reports, summarize premarket/aftermarket activity, identify top movers across a universe, or create a best-idea summary. Additionally, it adds an undeclared technical-pattern labeling capability (BUY/SELL/WAIT). While both relate to market data, the actual code only supports a small underlying component rather than the described end-to-end reporting functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a broad market-reporting skill capable of generating modular daily reports across global assets with configurable scope and multiple report components. The supplied code does not do that. It only retrieves and parses one specific webpage from TMX Money for Canadian markets and emits a movers list as JSON. While 'top movers' is one small subset of the declared functionality, the primary purpose and breadth are materially different: the code is a single-source scraper/pattern for Canadian movers extraction, not a general market report generator. There are no undeclared dangerous capabilities, but there is a substantial description-to-behavior mismatch due to overclaiming scope, configurability, and reporting features.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# Modular Market Brief

Create a concise but information-dense market report that is **modular** (can include/exclude sections) and **data-backed** (prices/returns/trend state when possible).

## Inputs to ask for (or assume defaults)
- **Time window:** AM (since prior close) vs PM (what changed since AM)

Static analysis

No suspicious patterns detected.