Trend Following

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:01 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed stock trend-analysis helper that fetches public market data and prints technical indicators, with no evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Install in a virtual environment and consider pinning yfinance before use. Treat the output as technical-analysis assistance, not financial advice, and be aware that the broad trigger may activate on bare ticker symbols unless the skill is tightened.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

- Requires `yfinance` (`pip install yfinance`)

The package is subsequently imported at scripts/trend_strategy.py:7:

python

import yfinance as yf

Technical Analysis

The documentation instructs users to install yfinance without specifying a reviewed version, cryptographic hashes, a lockfile, or other integrity controls. The command therefore resolves a mutable package version and its transitive dependencies at installation time.

The package name is legitimate and there is no evidence that the project intentionally selects a malicious dependency. Nevertheless, the effective code installed by a user is not fully determined by the audited project. A compromised upstream release, compromised package repository, or malicious transitive dependency could introduce code that was not present during this review. Such code may execute during package installation, module import, or subsequent use.

Attack Path

1. A user follows the setup instruction in SKILL.md.
2. The user runs pip install yfinance.
3. pip resolves the current package release and its transitive dependencies from the configured package index.
4. If an upstream package, release, dependency, index, or resolution path has been compromised, malicious code is installed.
5. The malicious component executes with the permissions of the user running pip, either during installation, when yfinance is imported, or when the analysis is performed.

This is a supply-chain exposure rather than evidence of an actively malicious package in the audited repository.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user who installs or runs the dependency. The resulting scope could include access to files, environment variables, network resources, and credentials availa ...[truncated 386 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yfinance and all transitive dependencies to versions that have been reviewed and tested.
2. Store the dependency definitions in a committed requirements or lock file instead of relying on an unconstrained installation command.
3. Generate and verify cryptographic hashes, for example by using a hash-locked requirements file with pip install --require-hashes.
4. Install dependencies in an isolated virtual environment or container under a non-privileged account.
5. Configure pip to use a trusted package index and avoid unreviewed additional indexes.
6. Use automated dependency vulnerability and provenance scanning, and update pinned versions through a controlled review process.
7. Replace the documented command with a reproducible installation command referencing the locked dependency file.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is broad enough to match generic stock-related phrases and potentially any ticker symbol, which can cause the skill to activate in contexts where the user did not explicitly request this analysis. Unintended invocation can override more appropriate skills, lead to misleading financial guidance, and increase the chance of acting on irrelevant or incomplete context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code prints a Chinese-language label ("【可能底部】") within otherwise English output, which imposes a locale choice on users without opt-in. The policy scope for this rule covers natural-language strings in code files, and there is no indication that the skill is intentionally region-specific or that users can select their preferred language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.