Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests
- Confidence
- 97% confidence
- Finding
- requests
Market Events
Security checks across malware telemetry and agentic risk
Overview
This is a straightforward Financial Modeling Prep market-calendar skill; its main issue is dependency hygiene, not hidden or malicious behavior.
Install only if you are comfortable using an FMP API key for market-event lookups. Use a dedicated, revocable FMP key, point --file only at simple ticker lists, and prefer a version that pins requests to a maintained safe release.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
- requests
VirusTotal
VirusTotal findings are pending for this skill version.