Bytesagain Quant Trader

• Outcome: Pass
• Latest audit: May 29, 2026, 8:35 PM
• Version:
  1.0.0

Overview

This is a local trading-analysis helper that runs a shell script, with no evidence of hidden data access, credential use, downloads, or trade execution.

Install only if you are comfortable running a local shell script for educational trading analysis. Review the script before use, verify all market data independently, and do not treat the generated signals or position sizing as financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises shell-based commands in SKILL.md but does not declare any permissions, which creates a transparency and governance gap around code execution capability. Even if the shown commands appear benign, undeclared shell access can be used to run arbitrary local commands or reach other resources once the backing script exists or is modified, so consumers may enable a more powerful skill than they realize.

VirusTotal

66/66 vendors flagged this skill as clean.