News Sentiment Scan

• Outcome: Pass
• Latest audit: May 29, 2026, 8:24 PM
• Version:
  1.0.0

Overview

This is a user-run stock news sentiment helper, but its documentation overstates how many sources it actually analyzes.

Install only in a controlled Python environment, review the yfinance and pandas dependencies, and treat the output as a rough Yahoo Finance headline sentiment summary rather than comprehensive market sentiment or investment advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The implementation only pulls Yahoo Finance news items and analyzes titles, while the skill description promises broader coverage across announcements, broker reports, and social media. In a financial-analysis context, this mismatch can materially mislead users into believing the output reflects comprehensive sentiment when it is actually based on a narrow and incomplete data source, creating decision-making risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring states that the script scans news, announcements, and social media, but the code only processes fetched news headlines. This is a specification-integrity issue: users and downstream agents may rely on inaccurate claims about data provenance and coverage, which is especially risky for trading or reputation-monitoring use cases.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill advertises monitoring across multiple external and social-media sources but does not clearly warn users that activation may perform network access to third-party platforms. In a financial-analysis context, silent outbound requests can expose user interest in specific securities, create privacy/compliance concerns, and surprise operators in restricted or audited environments.

VirusTotal

64/64 vendors flagged this skill as clean.