equity-research-analyst-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its equity-research purpose, but it deserves review because it recommends persistent plaintext API-key setup, live third-party requests, unpinned package installs, and unsafeguarded workbook edits.

Review before installing if you will use real RapidAPI credentials or live market-data calls. Prefer a project-scoped or secret-manager-backed key instead of ~/.zshrc, use a virtual environment with pinned dependencies for charting, back up any Excel model before allowing edits, and avoid the token-generation, MCP-token, and realtime endpoints unless you explicitly need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/initiating-coverage/task4-chart-generation.md:226

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: references/initiating-coverage/task4-chart-generation.md, line 226
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install matplotlib seaborn pandas numpy plotly

Technical Analysis

The Skill instructs users or agents to install five third-party Python packages without specifying versions, hashes, a lockfile, an approved package index, or an isolated virtual environment. Consequently, the packages installed during future executions may differ from those reviewed during the audit.

Python package installation can execute package-controlled build and installation logic with the privileges of the invoking user. A compromised upstream release, package-index account, dependency, or resolution path could therefore introduce arbitrary code. The use of legitimate and correctly spelled package names lowers the likelihood of typosquatting, but it does not eliminate upstream compromise or dependency-chain risk.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, or its package-index publishing account.
2. The attacker publishes a malicious release that satisfies the unrestricted dependency request.
3. A user or agent follows the Skill instruction and runs the documented pip install command.
4. Pip resolves and downloads the malicious version.
5. Package-controlled installation or runtime code executes under the invoking user's account.
6. The malicious code can access resources available to that account, potentially including project files, generated research artifacts, environment variables, and network connectivity.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running pip or subsequently importing the package. The accessible scope may include:

• Reading or modifying files available to the ...[truncated 484 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the inline installation command with a reviewed dependency manifest containing exact versions.
2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Run the chart workflow in a dedicated virtual environment rather than the user's global Python environment:

   bash

   python -m venv .venv
   . .venv/bin/activate
   python -m pip install --require-hashes -r requirements.txt
   

4. Pin the package index to an approved HTTPS source or controlled internal mirror.
5. Review dependency updates before changing the lockfile or hashes.
6. Avoid privileged installation and use preinstalled, vetted dependencies when available.
7. Add automated dependency vulnerability and provenance checks to release review.

T09 · Insecure Skill Coding Practices

Note

• Location: references/tradingviewapi-docs/README.md:73

Finding

RapidAPI Key Persisted in Plaintext Global Shell Configuration

Content

View full analysis

Vulnerability Details

File Location: references/tradingviewapi-docs/README.md, lines 73–89
Vulnerability Type: Excessively persistent plaintext credential storage
Risk Level: Low

Vulnerable Code:

bash

echo 'export RAPIDAPI_KEY="your_key_here"' >> ~/.zshrc
source ~/.zshrc

The surrounding guidance recommends this user-level shell environment variable as the default long-term solution and explains that it makes the key available across terminal sessions. It offers .env or direnv only as secondary options.

Technical Analysis

This configuration stores the RapidAPI credential in plaintext in a persistent shell startup file and exports it into every subsequent process launched from that shell. Although this keeps the key outside the Skill package, it unnecessarily broadens both the lifetime of the credential and the number of processes that can access it.

Any program operating under the same user account and able to read ~/.zshrc or inspect inherited environment variables may obtain the key. The credential may also be captured by home-directory backups, diagnostic archives, configuration synchronization, or accidental disclosure of shell configuration.

The audited API requests transmit the key only as an HTTPS authentication header to the documented RapidAPI host. That network transmission is necessary for the declared market-data functionality and is not covert exfiltration. The weakness is the recommended persistent storage and broad environmental exposure, not the authenticated API request itself.

Attack Path

1. A user replaces the placeholder with a real RapidAPI key and appends it to ~/.zshrc.
2. The key remains stored in plaintext across sessions.
3. Future shells export the credential to all child processes, including processes unrelated to equity research.
4. A malicious or compromised process running as the user reads the shell configuration or inherited environment.

...[truncated 829 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not recommend a plaintext shell startup file as the default credential-storage mechanism.
2. Prefer an operating-system credential manager, keychain, or dedicated secret manager.
3. Inject the credential only into the specific API process that requires it rather than exporting it globally.
4. If file-based storage is unavoidable:
   • Store the secret outside the Skill package and repository.
   • Restrict file permissions to the user, such as chmod 600.
   • Exclude the file from version control and backup or synchronization systems where appropriate.
   • Load the value only for the relevant command or isolated environment.
5. Avoid placing literal secrets directly in shell commands where command history or process inspection may expose them.
6. Document key rotation and revocation procedures.
7. Recommend separate, least-privilege API keys for automation and interactive use where the provider supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (72)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

- Use `references/tradingviewapi-docs/openapi.json` as the source of truth for exact parameters, defaults, and allowed enum values.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

- Use `references/tradingviewapi-docs/openapi.json` as the source of truth for exact parameters, defaults, and allowed enum values.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

Before Web Search, pull structured numeric data (financials, TTM ratios, analyst consensus, calendars, prices, technicals, news) from the bundled `tradingviewapi` (TradingView proxy). **One call to `/api/market-data/{symbol}` covers ~70% of the numeric content of a typical research report.**

- Full endpoint map, curl examples, and JSON-path-to-report-field mapping: `references/tradingviewapi.md`
- OpenAPI spec and example responses: `references/tradingviewapi-docs/`

**Authentication**: users must provide their own `RAPIDAPI_KEY` env var (RapidAPI hosted).

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest limits the skill to equity research on public companies, ETFs, or TradingView-resolvable tickers, but this file documents a full GET /api/news/crypto capability with extensive Bitcoin and altcoin news retrieval. Dedicated crypto market news is a separate domain from institutional-style equity research and is not justified by the stated purpose.

Content

No source excerpt is available for this finding.

Ae5

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Instruction-capable artifact exceeds whole-file semantic analysis limits

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/tradingviewapi-docs/openapi.json (reported line 5)May include surrounding context.

json

{
  "openapi": "3.0.3",
  "info": {
    "title": "TradingView API Server",
    "description": "Access 160,000+ stocks, forex, cryptocurrencies, and ETF data from around the world. Supports REST API and ultra-low latency WebSocket.\n\n## Basic Information\n\n- **Base URL:** `https://tradingview-data1.p.rapidapi.com`\n- **RapidAPI Host:** `tradingview-data1.p.rapidapi.com`\n- **Supported Format:** JSON\n\n## Authentication\n\nAll API requests require authentication via RapidAPI. Include the following headers in every request:\n\n```\nx-rapidapi-host: tradingview-data1.p.rapidapi.com\nx-rapidapi-key: YOUR_RAPIDAPI_KEY\n```\n\n> **Important:** Keep your API key secure and do

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

MCP token-generation functionality is not justified by the skill's equity research purpose and effectively grants a new authentication-bearing capability. If exposed through the skill, it could enable downstream tool access, session creation, or privilege expansion outside the intended research workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

General JWT generation for WebSocket/SSE access gives the skill the ability to mint access tokens for live data channels, which is materially broader than needed for static or periodic equity research. In the context of an agent skill, this can facilitate unauthorized persistent connections, expanded data exfiltration paths, or unintended service use.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/tradingviewapi.md (reported line 264)May include surrounding context.

Task 1 — Company Research:

bash

curl ".../api/market-data/NASDAQ:AAPL/company"          # Company basic info
curl ".../api/market-data/NASDAQ:AAPL/ipo"              # IPO info
curl ".../api/market-data/NASDAQ:AAPL/credit-ratings"   # S&P / Moody's / Fitch ratings

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

md

## `SKILL.md` Is The Real Entry Point

The most important file in this repository is [SKILL.md](/Users/barry/code/skills/equity-research-analyst/SKILL.md).

For git users, this `README.md` explains the repository. For AI agents, `SKILL.md` is the actual product entry point and the file that gets packaged into the distributable `.skill`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/earnings-analysis/workflow.md (reported line 78)May include surrounding context.

md

**❌ COMMON MISTAKES TO AVOID:**
- ❌ Using earnings data from training without searching
- ❌ Assuming "Q3 2024" is latest based on expectations
- ❌ Grabbing the first earnings release found without checking the date
- ❌ Not comparing the release date to today's date
- ❌ Proceeding when the release is 4+ months old

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/earnings-analysis/workflow.md (reported line 206)May include surrounding context.

md

**❌ COMMON MISTAKES TO AVOID:**
- ❌ Using earnings data from training without searching
- ❌ Assuming "Q3 2024" is latest based on expectations
- ❌ Grabbing the first earnings release found without checking the date
- ❌ Not comparing the release date to today's date
- ❌ Proceeding when the release is 4+ months old

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file instructs the analyst to find LinkedIn profiles and compile detailed bios including prior roles, education, and credentials for named executives. Because the skill description includes gathering and reproducing personal-profile information, it should warn users about privacy-sensitive data handling and reliance on public personal sources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow explicitly instructs the agent to modify an existing Excel financial model file and not create a separate file, but it does not require any confirmation, backup, versioning, or warning about overwriting prior work. In an agent setting, this can lead to silent corruption or loss of a user’s existing model, especially because valuation tabs are being added to a preexisting artifact that may contain important formulas, assumptions, or audit history.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The curl example initiates a real request to an external service and includes a placeholder for an API key header, which creates a concrete data egress path if copied into an agent workflow or executed by a user. In this equity research skill, outbound market-data access is contextually expected, but the lack of guardrails still makes it dangerous because symbols, prompts, or credentials could be sent to a third party without explicit user consent or secure secret handling.

Content

Scanner excerpt · references/tradingviewapi-docs/examples/01-price-data.md (reported line 14)May include surrounding context.

Request

bash

curl --request GET \
	--url 'https://tradingview-data1.p.rapidapi.com/api/price/BINANCE:BTCUSDT?timeframe=1&range=10' \
	--header 'x-rapidapi-host: tradingview-data1.p.rapidapi.com' \
	--header 'x-rapidapi-key: YOUR_RAPIDAPI_KEY'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tradingviewapi-docs/examples/02-quote-data.md (reported line 14)May include surrounding context.

Request

bash

curl --request POST \
	--url 'https://tradingview-data1.p.rapidapi.com/api/quote/batch' \
	--header 'Content-Type: application/json' \
	--header 'x-rapidapi-host: tradingview-data1.p.rapidapi.com' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples explicitly note that live requests are enabled and include authenticated curl commands using RapidAPI headers, but they do not warn that executing them will send data to a third-party service and consume paid credentials/quota. In a skill bundle, users may treat examples as safe to run, increasing the risk of unintended external transmission and credential misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes an equity research skill for public companies, ETFs, and TradingView-resolvable tickers, but this file documents leaderboard retrieval for crypto, futures, forex, government bonds, and corporate bonds in addition to stocks and ETFs. Those broader market-data surfaces materially expand the skill beyond institutional-style equity research and indicate behavior outside the claimed scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is positioned for equity research on public companies and ETFs, yet this example adds dedicated crypto leaderboard access with crypto-specific fields such as social dominance and crypto categories. That capability is not an obvious requirement for equity research and broadens the skill into digital-asset analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file includes a dedicated futures leaderboard endpoint covering yield and commodity futures. While futures may sometimes inform macro context, providing direct futures leaderboard functionality is a separate market-data capability not clearly justified by a skill whose stated role is institutional-style equity research.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented forex leaderboard exposes real-time currency-pair data and technical ratings, which is a standalone FX analysis capability. That goes beyond the stated purpose of researching public companies and ETFs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file documents dedicated government-bond and corporate-bond leaderboard endpoints with bond-specific measures such as yield to maturity, coupon, and maturity dates. Those are fixed-income research capabilities rather than obvious requirements for an equity-research skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples instruct users to send a live third-party API key in request headers to an external service, but provide no warning about credential sensitivity, storage, logging, or accidental disclosure. In an agent context, this raises the risk that operators paste real secrets into prompts, code, screenshots, or logs, enabling credential leakage and unauthorized API usage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest frames this as an equity-research analyst skill for companies, ETFs, and tickers, but the file documents GET /api/news/bond for bond-specific news retrieval. Bond-market coverage is a distinct asset-class capability and is not clearly justified by the declared equity-research purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as supporting institutional-style equity research on a public company, ETF, or ticker, but the documented GET /api/news/{newsId} example returns an unrelated Reuters story about a school bus accident in Colombia. That demonstrates behavior that is not scoped to equity/security research and suggests the endpoint can surface arbitrary general news content rather than issuer- or market-relevant research inputs.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: references/tradingviewapi-docs/openapi.json:2916