Chart Master

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward financial chart generator, with a dependency reproducibility caution but no evidence of hidden or malicious behavior.

Install only if you are comfortable with the skill resolving Python packages and fetching financial data at runtime. For stronger assurance, pin dependency versions or use a locked environment before running it on sensitive systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependencies resolved and installed at runtime
Risk Level: Medium

Vulnerable Code

bash

uv run --with yfinance --with mplfinance --with pandas {baseDir}/scripts/generate_chart.py --ticker "NVDA" --period "6mo" --interval "1d" --style "yahoo" --title "NVIDIA Daily Chart"

Technical Analysis

The documented execution command instructs uv to resolve and install yfinance, mplfinance, and pandas at runtime without version constraints or integrity hashes. The code that ultimately executes is therefore not fully represented by the audited project: package versions and transitive dependencies may change between invocations.

This creates a supply-chain exposure. If a package release, transitive dependency, configured package index, or dependency resolution source is compromised, malicious package installation or import-time code could execute as part of an otherwise legitimate chart-generation request.

The audit found no evidence that the project intentionally selects a typosquatted package or untrusted index. The issue is the lack of reproducible, integrity-verified dependency resolution.

Attack Path

1. An attacker compromises a named dependency, one of its transitive dependencies, or a package source used by uv.
2. The attacker publishes or substitutes a malicious version that remains compatible with unconstrained resolution.
3. A user or Agent runs the command documented in SKILL.md.
4. uv resolves and installs the attacker-controlled package version.
5. Malicious code executes during package installation, module import, or normal library invocation.
6. That code operates with the permissions and environmental access of the process running the Skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking process's privileges. Depending on the runtime environment, this ma ...[truncated 432 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an audited exact version rather than resolving the latest available release:

   bash

   uv run --with 'yfinance==AUDITED_VERSION' --with 'mplfinance==AUDITED_VERSION' --with 'pandas==AUDITED_VERSION' ...
   

2. Prefer a committed pyproject.toml and uv.lock so direct and transitive dependency versions are reproducible.
3. Require integrity verification through package hashes or an equivalent trusted artifact-verification mechanism.
4. Retrieve packages only from an explicitly configured, trusted package index; prevent fallback to untrusted or user-controlled indexes.
5. Build and scan a pre-provisioned environment instead of installing dependencies whenever the Skill is invoked.
6. Run the chart generator with least privilege in a sandbox that restricts filesystem access, environment-variable exposure, and unnecessary outbound network access.
7. Establish dependency update review and vulnerability-scanning procedures before regenerating the lockfile or approving newer releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.