yf-finance

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it can automatically install an unpinned third-party finance CLI, so users should review that dependency risk before installing.

Install only if you are comfortable letting the agent install and run the current yf-cli package through uv. Prefer pinning and reviewing a specific yf-cli version, and use care with examples that redirect output to files because they can overwrite existing files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:5

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:28-32
• scripts/install.sh:1-10

Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

Affected Code — SKILL.md:28-32:

bash

If the command is not found, install it:

```bash
uv tool install yf-cli

text

**Affected Code — `scripts/install.sh:1-10`**:

```bash
#!/usr/bin/env bash
# Verify yf-cli is installed; install via uv if missing.
set -euo pipefail

if ! command -v yf &>/dev/null; then
  echo "yf-cli not found — installing via uv..."
  uv tool install yf-cli
else
  echo "yf-cli $(yf --version) is ready."
fi

Technical Analysis

The Skill automatically installs yf-cli without specifying an exact version, package hash, lock file, or explicitly trusted package index. Consequently, the code reviewed during this audit does not fully determine the code that will eventually be installed and executed.

uv tool install yf-cli resolves the package and its transitive dependencies at installation time. A future release, compromised maintainer account, compromised package index, or malicious transitive dependency could therefore introduce code that was not present during the Skill review. Package installation may invoke build-system components, and subsequent yf commands execute the installed package under the Agent user's identity.

Installing a finance-data client is consistent with the Skill's declared purpose, but silently selecting the latest available release is not the minimum-risk method of providing that dependency. The examples state that outputs were captured from yf-cli 0.2.0, yet the installation instructions do not enforce that or any other reviewed version.

The reviewed files contain no evidence that yf-cli is currently malicious. This finding concerns the mutable, unverified dependency trust boundary rather than a confirmed malicious payload.

Attack Path

...[truncated 1353 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yf-cli to an exact, reviewed version in both installation locations, for example:

   bash

   uv tool install 'yf-cli==0.2.0'
   

   The selected version should be independently reviewed rather than assumed safe merely because it appears in the examples.

2. Use a lock file or equivalent mechanism that fixes all transitive dependency versions.

3. Verify package artifacts with trusted hashes or signatures. Prefer an installation workflow that fails closed when the artifact does not match the approved digest.

4. Configure an explicit trusted package index instead of relying on ambient index configuration or unintended fallback sources.

5. Avoid automatic installation without informed user approval. If yf is absent, report the missing dependency and request consent before modifying the user's tool environment.

6. Execute the CLI in a restricted environment with only the network and filesystem access required for public finance queries. Do not expose unrelated credentials or sensitive directories.

7. Keep the version in SKILL.md, scripts/install.sh, and the worked examples synchronized, and review dependency updates before changing the pin.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/output-formats.md (reported line 101)May include surrounding context.

text

**Use when:**
- The user wants to save data to a file (`> data.csv`)
- The user wants to open results in a spreadsheet

**Redirect to file:**

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes an example that redirects output to aapl.csv, which creates or overwrites a local file. The surrounding documentation does not warn users that the example performs a filesystem write, so a user following the example may do so without explicit disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.