Security audit
Security checks for vulnerabilities and agentic risk
This skill is a purpose-aligned Indian stock analysis API wrapper with disclosed external API use and no local execution, persistence, or credential access in the artifact.
Before installing, treat this as a third-party financial analysis API: do not send sensitive portfolio details unless you trust the provider, and verify any BUY/SELL-style output with independent financial judgment. The reviewed artifact does not show local system access or hidden behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- **Kong Route:** https://api.toolweb.in/tools/indian-stock-fundamental-analyzer
- **API Docs:** https://api.toolweb.in:8204/docs
This is a manifest-style file, so vague-trigger review applies. The title and description describe the skill broadly as stock analysis for Indian stocks, but they do not define any explicit invocation phrases, scope limits, or exclusion conditions, which can make activation criteria ambiguous in systems that infer tool use from manifest text.
The skill explicitly states it uses real-time web search for analysis but does not warn users that submitted stock tickers or company names may be transmitted to external services. This is a genuine transparency and privacy issue because users may assume analysis is self-contained and not realize their queries are shared with third-party infrastructure.
The natural-language title and description explicitly constrain the skill to Indian stocks and Indian exchanges. Because no user opt-in or justification is provided in this file, this may constitute a locale-specific policy constraint embedded in the skill metadata.