Stock Info Explorer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:54 AM UTC
• Version: 1.2.10

Overview

This stock-analysis skill does what it claims, with ordinary dependency and temporary-file risks users should understand before running it.

Install only if you are comfortable letting `uv` fetch the listed Python packages from your package index, and prefer running it in a normal user account or isolated environment. On shared machines, be aware chart output uses predictable `/tmp` filenames and may overwrite existing files for the same ticker.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/yf.py:2

Finding

Unpinned Third-Party Dependencies Are Automatically Resolved at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/yf.py:2-10
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

python

# /// script
# dependencies = [
#   "yfinance",
#   "rich",
#   "pandas",
#   "plotille",
#   "matplotlib",
#   "mplfinance"
# ]
# ///

Technical Analysis

The script declares six third-party dependencies without exact version constraints or integrity verification. The documented execution method uses uv run --script scripts/yf.py, which can resolve and install these dependencies when the script is run.

Because no reviewed versions or hashes are specified, the effective code executed by the Skill may change independently of the audited project. A compromised upstream release, dependency-confusion incident, unsafe package index configuration, or future incompatible package version could introduce arbitrary behavior into the execution environment.

The project contains no evidence that any currently named dependency is malicious. The risk arises from uncontrolled future dependency resolution rather than a confirmed malicious package.

Attack Path

1. An attacker compromises an upstream package release or the package index used by the execution environment.
2. The attacker publishes a malicious version under one of the dependency names declared by the script.
3. A user follows the documented uv run --script scripts/yf.py ... command.
4. uv resolves and installs the current package version because the dependency declaration does not constrain it to an audited version.
5. The malicious package code executes during installation or import in the context of the user running the Skill.

Impact Assessment

A compromised dependency would execute with the same operating-system privileges as the invoking user. Depending on those privileges, it could access user-readable files, steal environment credentials, modify user-owned data, make unauthorized n ...[truncated 136 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to an exact, reviewed version.
• Use a committed lockfile where the selected execution workflow supports one.
• Require package hashes or another integrity-verification mechanism.
• Restrict package resolution to an explicitly configured trusted index.
• Perform dependency updates through a controlled review and vulnerability-scanning process.
• Consider running chart generation in a restricted environment with minimal filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yf.py:135

Finding

Predictable Chart Paths in Shared Temporary Directory Permit File Clobbering

Content

View full analysis

Vulnerability Details

File Location: scripts/yf.py:135 and scripts/yf.py:319-322
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

python

path = f"/tmp/{symbol}_pro.png"

The same unsafe pattern is used for simple charts:

python

plt.figure(figsize=(10,6))
plt.plot(hist.index, hist['Close'])
path = f"/tmp/{symbol}_simple.png"
plt.savefig(path)
plt.close()

Technical Analysis

Chart files are written to deterministic, ticker-derived names in the globally shared /tmp directory. The implementation does not use exclusive file creation, a private temporary directory, randomized filenames, or explicit symbolic-link protection.

On a multi-user system, another local user can predict the output path and create a symbolic link at that location before chart generation. Plotting libraries generally open the supplied output path for writing and may follow the symbolic link, causing a victim-writable target file to be overwritten with PNG data. Independent concurrent invocations using the same ticker can also overwrite each other's chart output.

Attack Path

1. An attacker identifies a ticker that the victim is likely to process, such as TSLA.
2. The attacker creates a symbolic link at the predictable path, such as /tmp/TSLA_pro.png, pointing to a file writable by the victim account.
3. The victim runs the documented chart or report command for that ticker.
4. save_pro_chart passes the attacker-controlled filesystem path to mplfinance, or the simple chart branch passes it to plt.savefig.
5. The plotting operation follows the symbolic link and overwrites the target with PNG content.

Impact Assessment

The issue can overwrite or corrupt files that are writable by the invoking user. It does not, by itself, bypass operating-system permissions or grant privileges beyond those already held by the victim process. The practical scope includes deni ...[truncated 139 chars]

Remediation

View remediation

Remediation Suggestions

• Create chart files with tempfile.NamedTemporaryFile(delete=False, suffix=".png") or tempfile.mkstemp().
• Use randomized, exclusively created filenames rather than predictable names in shared /tmp.
• Place generated files in a private temporary directory created with tempfile.TemporaryDirectory() and restrictive permissions.
• Ensure output files are created with permissions limited to the invoking user.
• Do not check a path and subsequently reopen it by name, because that introduces a time-of-check/time-of-use race.
• Validate and sanitize ticker values before using them in display names or filesystem-related operations.
• Apply the same secure temporary-file mechanism to both professional and simple chart generation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.