ia-pinescript

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, with the main caution being financial-analysis guidance that could mislead users if copied into live trading logic.

Install only if you understand it is a trading-code aid, not financial advice. If you use its Pine Script examples, keep any forward-looking references strictly for offline labeling or evaluation, and verify that live alerts, entries, exits, and published backtests use only data available at that bar.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly recommends using forward-looking data (`close[lookforward]`) to measure prediction accuracy without clearly separating this from valid live-signal logic or warning about lookahead bias. In a Pine Script skill, that guidance can easily be copied into indicators or strategies, producing misleading backtests and potentially unsafe trading decisions based on non-causal data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal