Security audit
Security checks for vulnerabilities and agentic risk
This portfolio-tracking skill is coherent and not malicious, but it asks for sensitive holdings and cost-basis details without clear privacy, storage, or alerting controls.
Review this skill carefully before installing. It does not show malicious behavior, but users should avoid entering detailed holdings or cost-basis information unless they understand where that data is stored, how alerts are maintained, and how to review or delete saved portfolio data.
The trigger phrase "stock price" is broad enough to match ordinary finance-related conversation that may not be an intentional invocation of this skill. That can cause accidental activation in contexts where a user is merely discussing markets, increasing the chance of unintended processing of portfolio-related data or confusing skill routing.
The trigger phrase "crypto price" is similarly generic and likely to collide with common user requests about cryptocurrency markets. In a conversational assistant, such broad matching can invoke the skill unintentionally, exposing or soliciting sensitive holdings information without clear user awareness.
The skill encourages users to provide holdings, share counts, and purchase prices, but it does not clearly warn that this financial data will be stored or processed. Because portfolio composition and cost basis are sensitive personal financial information, lack of upfront disclosure can lead users to reveal data without informed consent or understanding of retention and privacy implications.
No suspicious patterns detected.
