Finance Radar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:17 AM UTC
• Version: 1.1.0

Overview

This finance skill mostly matches its stated purpose, but it automatically installs code at runtime and can charge a billing account or persist financial data with weak user controls.

Review before installing. Use it only in an environment where network access to Yahoo Finance and SkillPay is acceptable, preinstall and pin yfinance instead of allowing runtime installation, avoid passing SkillPay keys on the command line, and require explicit user approval before any charge, CSV export, or portfolio/watchlist write.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/analyze.py:6

Finding

Unpinned Third-Party Package Is Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location:

• scripts/analyze.py:6-14
• scripts/dividend.py:6-12
• scripts/hot_scan.py:6-12
• scripts/portfolio.py:8-14
• scripts/rumor.py:5-12
• scripts/score.py:5-12
• scripts/watchlist.py:8-14

Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

Representative implementation from scripts/analyze.py:

python

def ensure_yfinance():
    try:
        import yfinance
        return yfinance
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
        import yfinance
        return yfinance

Equivalent runtime installation logic appears in the other listed scripts.

Technical Analysis

When yfinance is unavailable, the Skill invokes pip install yfinance during normal command execution. The dependency is neither pinned to a reviewed version nor verified using package hashes. Consequently, the code that ultimately executes can change after the Skill itself has been audited.

pip may download the latest available yfinance release and its transitive dependencies from the package index configured in the execution environment. Installation and subsequent import can execute package-controlled Python code with the same operating-system privileges as the Skill process.

This creates a supply-chain exposure. Exploitation would require compromise or manipulation of a package release, a transitive dependency, the configured package index, package-resolution settings, or the network trust path. The audit found no evidence that the Skill intentionally selects a malicious package or unsafe nonstandard repository; the weakness is the uncontrolled runtime retrieval and execution model.

Attack Path

1. An attacker compromises a package version, transitive dependency, or package source used by the local pip conf ...[truncated 1042 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all automatic pip install calls from runtime command paths.
2. Declare yfinance and its required transitive dependencies in a controlled dependency manifest.
3. Pin dependencies to reviewed versions and use a lockfile with cryptographic hashes.
4. Install dependencies during a separate, explicit setup phase rather than while processing a user request.
5. Use an isolated virtual environment with only the permissions required for finance analysis.
6. Configure installation to use an approved package repository and require integrity verification.
7. If the dependency is absent at runtime, fail safely with an actionable error instead of downloading executable code.
8. Add automated dependency scanning and a documented update-review process.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/billing.py:58

Finding

SkillPay API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/billing.py:58-67
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Low

Vulnerable Code

python

if __name__ == "__main__":
    p = argparse.ArgumentParser()
    p.add_argument("--user-id", required=True)
    p.add_argument("--amount", type=float, default=0.001)
    p.add_argument("--api-key", default=None)
    g = p.add_mutually_exclusive_group()
    g.add_argument("--charge", action="store_true", default=True)
    g.add_argument("--balance", action="store_true")
    g.add_argument("--payment-link", action="store_true")
    a = p.parse_args()

The supplied value is subsequently selected by:

python

def _key(o=None):
    return o or os.environ.get("SKILLPAY_API_KEY")

Technical Analysis

The billing interface permits the SkillPay credential to be supplied as --api-key. Command-line arguments may be visible in process inspection tools while the command runs and may be retained by shell history, Agent execution logs, orchestration telemetry, debugging output, or audit systems.

Although the code also supports the SKILLPAY_API_KEY environment variable and does not print the key directly, the command-line option creates an avoidable credential disclosure path. Exploitation requires local process visibility or access to a system that records command invocations.

The billing network request itself uses HTTPS and sends the key in the X-API-Key header to the fixed, declared https://skillpay.me/api/v1 endpoint. The audit did not find evidence that the key is intentionally transmitted to unrelated hosts.

Attack Path

1. A user or Agent invokes scripts/billing.py with --api-key followed by a valid SkillPay credential.
2. The complete invocation becomes visible in a process listing or is retained in shell history, telemetry, or command-execution logs.
3. A local user or party with ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option.
2. Retrieve the key from a protected secret manager or controlled environment injection mechanism.
3. Ensure execution frameworks redact credential-bearing environment variables and HTTP authorization headers from logs.
4. Apply least privilege to the SkillPay key and separate billing capabilities where the service supports scoped credentials.
5. Document credential rotation and revoke any key suspected of appearing in command history or telemetry.
6. Avoid returning unnecessary billing-provider response fields that could contain sensitive account metadata.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code does support part of the declared description: single-ticker stock/crypto analysis using Yahoo Finance data, including price, some fundamentals, dividend yield, and recent trend. However, the declared purpose substantially overstates functionality. There is no code for portfolios, watchlists, alerts, scanners, rumor detection, earnings-event analysis, multi-asset trend discovery, or any billing integration. The primary implemented behavior is narrow single-ticker quote/fundamental retrieval rather than the broader monitoring/scanning platform described.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises executable scripts that imply network access, shell execution, file output/export, and use of environment secrets, but it does not declare any tool scope or permissions boundary in the manifest. This creates a transparency and containment problem: orchestrators or reviewers cannot easily restrict what the skill is allowed to do, increasing the chance of unintended data access, external calls, or file writes when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation text is very broad and covers many common investing requests, which can cause the skill to trigger in situations where users did not clearly consent to portfolio analysis, watchlist handling, rumor scanning, or billable actions. In a finance context, overbroad routing is more dangerous because outputs may influence financial decisions and may process sensitive user financial interests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documents portfolio tracking and batch export features without warning that these functions may process or persist sensitive financial data such as holdings, watchlists, and exported CSVs. In a financial-analysis skill, inadequate disclosure raises privacy and data-handling risk because users may not realize their investment data could be written to files or sent through external integrations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Installing packages dynamically during normal execution is not required for stock/crypto analysis and creates a software supply-chain exposure. If package resolution is tampered with or a dependency is compromised, the skill may execute attacker-controlled code simply from being run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill silently launches a subprocess to install software with no user-facing warning, confirmation, or policy check. This violates least surprise and can lead to unauthorized environment modification, making exploitation or accidental unsafe changes harder to detect and control.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The code invokes pip in a subprocess at runtime to install yfinance automatically. This expands the skill's execution surface to arbitrary package download and install behavior, introducing supply-chain risk and allowing unreviewed code to be fetched and executed in the current environment without explicit operator consent.

Content

Scanner excerpt · scripts/analyze.py (reported line 12)May include surrounding context.

python

return yfinance
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
        import yfinance
        return yfinance

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The formatted output uses Chinese labels such as 类型, 货币, and 价格 for all users, with no option to select another language. This is a natural-language policy concern because the skill imposes a specific locale without opt-in or justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes stock/crypto analysis, portfolio/watchlist monitoring, alerts, scoring, rumor/trend detection, and earnings reaction checks, but does not mention exporting or persisting results to the local filesystem. This file adds a concrete data-export capability by creating directories and writing CSV files under the user's home workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing strings in the formatted output are fixed in Chinese, including headers, error labels, and usage guidance. This enforces a specific language on all users without opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The charge() path initiates a real billing operation against an external payment API using a supplied user_id and amount, but the script itself provides no confirmation gate, consent check, or anti-abuse control before charging. In the context of an agent skill with per-call billing, this creates a real risk of unintended or automated charges if upstream components invoke it without explicit user authorization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatically installing packages at runtime is unnecessary for simple dividend analysis and creates a supply-chain and environment-integrity risk. If the package source, dependency chain, or execution environment is compromised, the script may pull and execute untrusted code under the user's interpreter.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The subprocess-based package installation occurs silently, without warning or consent, which can surprise users and administrators and bypass expected change-control. In restricted or sensitive environments, this can violate policy, alter system state, or trigger execution of newly downloaded code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script invokes pip at runtime via a subprocess to install yfinance automatically. This is risky because it performs code-fetching and code-execution behavior during normal use, expands the trust boundary to package indexes and the network, and can modify the local Python environment without explicit user approval.

Content

Scanner excerpt · scripts/dividend.py (reported line 11)May include surrounding context.

python

import yfinance; return yfinance
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
        import yfinance; return yfinance

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The formatted output uses Chinese labels and messages exclusively, with no option for the user to select another language. This is a natural-language policy concern because the skill enforces a specific locale rather than offering opt-in or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Installing packages during execution is not necessary to fulfill the stated purpose of scanning market tickers and creates an avoidable supply-chain and environment-integrity risk. In the context of a finance analytics skill, unexpected dependency installation is more suspicious because users would not reasonably expect the tool to modify the host or fetch executable code from the network just to display ticker rankings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code automatically installs a package without any warning or confirmation, removing user or operator control over whether code from an external repository should be executed. This is dangerous because it can surprise users, violate least-privilege expectations, and expose the environment to dependency compromise or policy violations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script executes a pip install at runtime, which causes arbitrary code from an external package and its dependency chain to run in the host environment without prior review or approval. Even though the package name is hardcoded and not user-controlled, this still expands the trust boundary, introduces supply-chain risk, and performs an unexpected system-modifying action for a read-only market scanner.

Content

Scanner excerpt · scripts/hot_scan.py (reported line 11)May include surrounding context.

python

import yfinance; return yfinance
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
        import yfinance; return yfinance

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The formatted output includes Chinese labels and a bilingual heading by default, with no option for the user to choose language or locale. This is a natural-language policy issue because the skill imposes a specific locale presentation rather than offering opt-in or configurability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Self-installing Python packages at runtime is a real security issue here because portfolio tracking does not require modifying the host environment during execution. It introduces supply-chain risk, implicit network access, and arbitrary third-party code execution without an explicit trust decision by the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Automatically invoking pip via subprocess changes the system state and may fetch code from external sources without a prior user warning or approval flow. In the context of a finance skill, this is more concerning because users do not reasonably expect environment modification just to view or manage a portfolio.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The code spawns a subprocess to run pip and install yfinance at runtime. This is dangerous because it performs undeclared code acquisition and execution in the user's environment, expanding the trust boundary to package indexes and network transport, and can surprise users or fail in restricted environments.

Content

Scanner excerpt · scripts/portfolio.py (reported line 13)May include surrounding context.

python

import yfinance; return yfinance
    except ImportError:
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "yfinance", "-q"])
        import yfinance; return yfinance

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

All human-readable output strings are in Chinese, and the skill provides no option for the user to select another language. This is a natural-language locale policy concern because the script imposes a specific language without opt-in or explanation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Self-installing Python packages at runtime is a genuine security issue here because the capability is unrelated to core financial analysis and expands the script's ability to change the system state. In a finance skill, this behavior is less justified and increases supply-chain and environment-tampering risk if an attacker can influence package resolution, indexes, or dependencies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs automatic pip installation without any user-facing notice or confirmation, causing unexpected code and dependency changes on the host. This reduces transparency and consent, and can expose operators to unreviewed package execution and persistence of environment modifications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.