Finance News Assistant

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  1.0.0

Overview

This finance-news skill is instruction-only and uses a disclosed stock API for its stated purpose, with no hidden execution or destructive behavior found.

Install only if you trust the fixed stock API provider at tczlld.com. Use a scoped STOCK_API_TOKEN, configure Feishu delivery only for intended recipients, and independently verify prices, news, and any buy/sell or position suggestions before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs sending stock codes to a remote AI decision endpoint and using an authorization token, but it provides no user-facing disclosure that requests and associated metadata will leave the local environment. Even if stock codes are not highly sensitive by themselves, undisclosed external transmission can expose user interests, trading intent, request metadata, and operational secrets to a third party, especially in a finance context where access patterns may be sensitive.

VirusTotal

65/65 vendors flagged this skill as clean.