Stocks and Financial Data Pull Crypto Finance Cryptocurrency Price Earnings Dividends

• Outcome: Pass
• Latest audit: Oct 11, 2026 · 2:23 AM UTC
• Version: 5.0.0

Overview

This skill is a disclosed Yahoo Finance data tool that installs pinned Python dependencies and fetches market data, with no evidence of hidden persistence, credential access, destructive behavior, or unrelated data collection.

Install only if you are comfortable creating a local Python virtual environment and sending requested tickers, searches, and related financial interests to Yahoo Finance via yfinance. Avoid using confidential portfolio/watchlist identifiers if that exposure is unacceptable, and run self-test or complete-analysis only when you intend a high-volume data pull.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to create a virtual environment, install dependencies, and invoke a Python CLI that fetches Yahoo Finance data, which implies executable code with network access. However, the manifest declares no explicit tool scope such as permissions or allowed-tools, so an agent runtime may not have a clear policy boundary for network-capable execution. In a skill that retrieves external market data, this increases risk of unintended outbound access and weakens reviewability of what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/cli.py (reported line 60)May include surrounding context.

python

logging.basicConfig(level=logging.WARNING)
    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
    try:
        module = __import__(MODULE)
    except ImportError as e:
        print(f"Missing dependency ({e}). Set up the skill first:\n  {SETUP}", file=sys.stderr)
        return 2

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill performs extensive outbound requests to Yahoo Finance and may retrieve third-party news content, but it does not provide a clear user-facing disclosure that queries and identifiers will be sent to external services. In agent environments, this can leak sensitive user interests, portfolio symbols, or proprietary watchlists to third parties without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The self-test and complete-analysis features can trigger dozens of outbound requests in one invocation, creating a denial-of-wallet/rate-limit risk and potentially generating unexpected traffic to third-party services. In an agent setting, a user may invoke these features without understanding the request volume, causing throttling, service disruption, or unnecessary exposure of requested symbols and behavior patterns.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/yfinance_ai.py (reported line 5374)May include surrounding context.

python

"""Fetch a Yahoo calendar DataFrame for the next N days"""
        days = max(1, min(int(days), 90))
        start = datetime.now().date()
        return getattr(yf.Calendars(), method)(start=start.isoformat(),
                                               end=(start + timedelta(days=days)).isoformat(),
                                               limit=max(1, min(int(limit), 100)))

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/yfinance_ai.py (reported line 5934)May include surrounding context.

python

for tool_name, args in tools:
                try:
                    method = getattr(self, tool_name)
                    response = await method(*args)

                    # Analyze response

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/yfinance_ai.py (reported line 6145)May include surrounding context.

python

}
                    })

                method = getattr(self, func_name)
                response = await method(ticker, *args)
                functions_run += 1

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/yfinance_ai.py (reported line 6168)May include surrounding context.

python

}
                    })

                method = getattr(self, func_name)
                response = await method(ticker, *args)
                functions_run += 1

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/yfinance_ai.py (reported line 6242)May include surrounding context.

python

}
                    })

                method = getattr(self, func_name)
                response = await method(ticker, *args)
                functions_run += 1

Static analysis

No suspicious patterns detected.