Security audit
Security checks for vulnerabilities and agentic risk
This stock-analysis skill is coherent and disclosed, with expected web data lookup but no hidden persistence, credential access, or destructive behavior.
Before installing, understand that the skill may contact third-party financial sites using stock tickers or company names you provide, and its investment conclusions should be treated as research assistance, not professional financial advice.
The trigger phrases are broad enough to match ordinary investing conversations, which can cause the skill to activate in situations the user did not clearly intend. In a skill that may perform detailed analysis and invoke external data-gathering tools, ambiguous activation increases the risk of unexpected tool use, misleading outputs, or overreach into regulated financial-advice-like behavior.
The skill explicitly instructs the agent to use exec+curl, web_fetch, and browser access to third-party financial sites, but it does not clearly disclose outbound network activity or obtain user confirmation. This can lead to unexpected transmission of user-provided stock interests or query contents to external services and creates unnecessary exposure to untrusted remote content.
No suspicious patterns detected.
