canslim-analysis

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:56 AM UTC
• Version: 1.0.3

Overview

This skill runs a disclosed stock-analysis pipeline that fetches public market data, writes reports locally, and does not show hidden exfiltration, persistence, or destructive behavior.

Install only in the documented virtual environment, run it without unnecessary local credentials in scope, and treat the stock output as research rather than investment advice. The main residual risk is ordinary Python supply-chain exposure from broad dependency ranges and external public market-data/AI-enrichment processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: Scripts/requirements.txt:3

Finding

Mutable and Unhashed Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: Scripts/requirements.txt:3-8
Vulnerability Type: Supply-chain exposure through mutable dependency resolution
Risk Level: Medium

Vulnerable Code

text

yfinance>=0.2.28,<0.3.0
pandas>=2.0.0,<3.0.0
lxml>=5.0.0,<6.0.0
tqdm>=4.65.0,<5.0.0
requests>=2.31.0,<3.0.0
reportlab>=4.0.0,<5.0.0

The installation of these dependencies is required by SKILL.md:153-156 and documented in README.md:30-33:

bash

pip install --no-cache-dir -r Scripts/requirements.txt

Technical Analysis

The dependency file permits any package release within broad version ranges and does not provide integrity hashes. Consequently, installation is not reproducible: the same command can resolve to different direct or transitive package versions over time.

If an allowed future release, dependency account, package repository, or transitive dependency is compromised, pip may install attacker-controlled code without any project changes. --no-cache-dir does not provide integrity verification and may increase reliance on freshly retrieved repository content.

This also conflicts with the README statement that dependency versions are pinned. The use of a virtual environment limits package installation to that environment, but it does not sandbox package installation or runtime code from the invoking user's files, environment variables, network access, or operating-system privileges.

Attack Path

1. An attacker compromises a permitted package release or one of its unresolved transitive dependencies.
2. The malicious release remains within the version ranges specified in Scripts/requirements.txt.
3. A user or Agent follows the mandatory installation instructions.
4. pip resolves and downloads the compromised release because no exact lock or trusted hash constrains the artifact.
5. Malicious package installation or runtime code executes with the pri ...[truncated 1099 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version using ==.

2. Resolve and lock all transitive dependencies rather than only the six direct packages.

3. Generate cryptographic hashes for every accepted distribution and install with:

   bash

   pip install --require-hashes -r Scripts/requirements.txt
   

4. Generate the lock file through a controlled process such as pip-compile --generate-hashes, and review changes before updating it.

5. Restrict installation to a trusted Python package index or an internally controlled package mirror.

6. Prefer reviewed wheels and explicitly control whether source distributions are permitted.

7. Add automated vulnerability, provenance, and dependency-drift checks to release workflows.

8. Correct the README claim that versions are pinned until exact pins and hashes are actually used.

9. Run the Skill in a least-privileged environment without unnecessary credentials, sensitive mounts, or broad filesystem access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims a hybrid qualitative/quantitative analysis over US stocks, but the documented behavior indicates external data fetching, a narrower universe, intermediate file persistence, and qualitative fields that may remain unverified until a later phase. This gap matters because users may approve or rely on the skill under false assumptions about data scope, network use, and analytic completeness, increasing the chance of unintended data exposure or unsafe execution in environments that did not expect those capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

The skill claims a hybrid qualitative/quantitative analysis over US stocks, but the documented behavior indicates external data fetching, a narrower universe, intermediate file persistence, and qualitative fields that may remain unverified until a later phase. This gap matters because users may approve or rely on the skill under false assumptions about data scope, network use, and analytic completeness, increasing the chance of unintended data exposure or unsafe execution in environments that did not expect those capabilities.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- `Scripts/quantitative_analyzer.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

- `Scripts/quantitative_analyzer.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

- `Scripts/quantitative_analyzer.py`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README states that AI qualitative analysis is performed automatically and that external data is fetched, but it does not clearly disclose what data may be transmitted to external AI services, when transmission occurs, or what third parties may receive it. This creates a transparency and privacy risk because users may run the skill assuming processing is local when portfolio symbols, intermediate analysis data, or derived investment information could be sent off-system.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares no explicit tool scope even though its instructions require shell execution, filesystem reads/writes, package installation, and likely network access for dependency installation and market-data enrichment. Missing permission declarations weaken reviewability and enforcement boundaries, making it easier for a skill to perform broader actions than a user or platform expects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · Scripts/final_process.py (reported line 316)May include surrounding context.

python

pdf_generator_path = os.path.join(script_dir, "pdf_report_generator.py")
        if os.path.exists(pdf_generator_path):
            logger.info("Generating PDF report...")
            result = subprocess.run(
                [sys.executable, pdf_generator_path],
                cwd=script_dir,
                capture_output=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Executing a child process is a materially broader capability than ordinary in-process data analysis. For a skill described as performing CANSLIM analysis and returning ranked candidates, calling subprocess.run to launch another script is not an obvious requirement of the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script writes final_canslim_report.json to disk, which modifies user-visible files. Although the action is logged afterward, there is no prior confirmation prompt, inline comment/docstring warning, or other user-facing disclosure before the write occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a CANSLIM analysis pipeline that returns a ranked shortlist, which matches most of this file's scoring and ranking logic. However, this code also invokes a separate script to generate a PDF report, adding a document-production behavior not stated in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script launches another Python program via subprocess.run to generate a PDF report. While progress is logged at runtime, there is no earlier comment, docstring, or explicit user warning that the skill will execute a secondary script as part of processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code performs a local file write to intermediate_canslim.json. Although the script logs the final saved path afterward, there is no prior user disclosure in comments, docstrings, or a prompt that the skill will create or overwrite a file in its directory.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

lxml is only range-pinned (>=5.0.0,<6.0.0), so builds can resolve to different releases over time, making it impossible to prove from this file alone that all installs avoid known vulnerable versions. Because lxml has a history of security issues in parsing and HTML-cleaning functionality, non-reproducible dependency resolution increases supply-chain and patch-management risk, especially if the skill processes external content.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: tqdm has 4 known advisory(ies) (CVE-2024-34062 (tqdm CLI arguments injection attack); CVE-2016-10075 (TDQM Arbitrary Code Execution); CVE-2016-10075 (The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to e) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 71% confidence

Finding

tqdm is specified as a version range rather than an exact pinned release, so the dependency installed may vary by environment and time. Although tqdm is typically lower-risk in this context, lack of deterministic pinning means a vulnerable or unexpected release could be pulled in, which is a legitimate supply-chain hardening issue.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

requests is a network-facing library and is only constrained by a broad range (>=2.31.0,<3.0.0), so the exact installed version is not guaranteed. In a skill that likely fetches market data or remote resources, unresolved dependency versions can materially increase exposure to known or future client-side HTTP issues such as credential leakage or TLS/redirect handling flaws.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: reportlab has 8 known advisory(ies) (CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

reportlab has several historical high-severity issues, including code-execution and SSRF-related bugs, and this manifest does not pin it to an exact release. Since this skill may generate reports, a floating allowed version creates avoidable uncertainty about whether installations consistently use a safe build, particularly if any report content incorporates external or user-controlled data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.