Security audit

LOFMonitor Finance Stock Investment

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward LOF fund premium/discount monitoring script with dependency hygiene issues but no evidence of hidden, destructive, credential-seeking, or persistent behavior.

Before installing, consider pinning dependencies in a lockfile and adding beautifulsoup4 explicitly. Treat the output as informational market data, not financial advice, and be aware the script contacts third-party financial-data sites when run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only, which allows installation of any newer version, including unexpected major releases or compromised/transitively risky versions. This weakens build reproducibility and increases supply-chain exposure because the resolved package can change over time without review.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Confidence: 89% confidence
Finding: Using an unpinned pandas version makes installs non-reproducible and can pull in later releases with behavior changes or newly introduced issues. In this file it is somewhat mitigated by the minimum version being above the disputed vulnerable range cited by the scanner, but exact resolution is still uncontrolled.

Unpinned Dependencies

Low

Category: Supply Chain
Content: akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Confidence: 96% confidence
Finding: Specifying requests with only a minimum version permits installation of a wide range of versions, including ones with known advisories if dependency resolution selects them. This creates avoidable supply-chain and reproducibility risk, especially for a library commonly used in network-facing code.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 86% confidence
Finding: The requests dependency is not upper-bounded or pinned, and the package has multiple historical advisories. Depending on environment, resolver behavior, mirrors, or downstream constraints, an affected version could still be installed, exposing the skill to credential leakage, improper TLS/session behavior, or other HTTP-client security issues.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.