Stanley Druckenmiller Workflow

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:10 PM UTC
• Version: 1.1.11

Overview

This is a disclosed market-analysis skill that fetches public financial data and writes a local cache, with some financial-advice boundary and dependency-supply-chain risks users should understand.

Install this only if you want a macro-trading style research workflow. Treat its outputs as research framing, not investment advice, and consider disabling finshare unless needed, using a virtual environment, pinning finshare/akshare versions, and only setting FRED_API_KEY if you are comfortable sending it to FRED's API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:83

Finding

Unpinned Third-Party Dependencies Allow Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:83-86; related runtime imports at scripts/market_panels.py:29-32 and scripts/market_panels.py:220-225
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

README.md:83-86:

markdown

#### 1) Install optional dependencies

```bash
pip install finshare akshare

text

`scripts/market_panels.py:29-32`:

```python
try:
    import akshare as ak  # type: ignore
except Exception:  # noqa: BLE001
    ak = None

scripts/market_panels.py:220-225:

python

try:
    import finshare as fs  # type: ignore
except Exception as exc:  # noqa: BLE001
    return {"ok": False, "symbol": symbol, "error": f"finshare unavailable: {exc}"}

Technical Analysis

The installation instructions retrieve the latest available finshare and akshare releases without version constraints, cryptographic hashes, or a lock file. The script subsequently imports and invokes these packages during normal market-data collection. The default finshare mode is first, making that dependency the preferred data provider when installed.

Python packages can execute arbitrary code during installation and module initialization. Consequently, a compromised upstream release, package-index account, distribution channel, or dependency subtree could introduce executable code after this Skill has been reviewed. Future incompatible releases could also silently alter data-source behavior or return manipulated market information.

The source code does not demonstrate that either current package is malicious. The confirmed issue is the absence of dependency pinning and integrity controls, which leaves runtime behavior dependent on mutable external artifacts.

Attack Path

1. An attacker compromises the publishing account, release process, distribution path, or transitive dependency of finshare or akshare.
2. The attacker publishes a malicious or backdoored ...[truncated 1195 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a reviewed, exact version rather than installing the latest release:

text

finshare==REVIEWED_VERSION
akshare==REVIEWED_VERSION

2. Generate a lock file containing cryptographic hashes and require hash verification during installation, for example with:

bash

python -m pip install --require-hashes -r requirements.lock

3. Review and lock all transitive dependencies, not only the two direct packages.

4. Install dependencies in a dedicated virtual environment or restricted container using a non-privileged service account.

5. Configure an explicit trusted package index or an internally controlled package mirror. Avoid allowing untrusted supplemental indexes that could enable dependency confusion.

6. Keep optional providers disabled until the user explicitly enables them. In particular, consider changing the default finshare mode from first to off or requiring an explicit opt-in after installation.

7. Add automated dependency scanning, release provenance verification, and periodic review before updating locked versions.

8. Document the packages’ network behavior and ensure secrets such as FRED_API_KEY are not exposed to optional provider code unless required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A description-behavior mismatch is a security-relevant transparency failure: the skill claims to generate user-facing analytical judgments, but the detected behavior is backend aggregation/caching. Misrepresented behavior can bypass user scrutiny and safety review, especially when combined with undeclared tool access, because a seemingly harmless briefing skill may actually collect, store, or transmit data in the background.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase set is broad enough to match common market-analysis requests, which can cause the skill to activate in situations where the user did not explicitly request this specific workflow. In a financial-analysis skill, unintended activation is risky because it may inject persuasive investment-oriented framing or quasi-advisory content into general conversations, increasing the chance of overreliance or policy-boundary violations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pre-trade trigger includes phrases like 'should I buy/sell' and 'sanity-check this trade,' which are highly likely to overlap with ordinary user investment questions and can pull the skill into sensitive decision-support scenarios. In this context, accidental activation is more dangerous because the skill is specifically designed to produce decision-oriented output, so even with disclaimers it may functionally steer trading behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises a documentation-only analytical workflow, yet static analysis detected capabilities implying environment access, file read/write, and network use without any declared tool scope. That creates a hidden privilege boundary problem: operators and users cannot tell what external access the skill may exercise, which increases the risk of data exfiltration, prompt-injection-assisted retrieval, or unauthorized persistence if the implementation is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when the user asks for items such as a pre-market view, intraday state update, end-of-day review, market-location read, portfolio-bias guidance, or industry priority. Several of these are generic finance-assistant requests rather than narrowly scoped trigger phrases, and the file does not provide negative examples or explicit exclusion conditions to prevent over-invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Its job is not to' section explicitly says the skill should not issue individual stock buy/sell calls. However, later output requirements include 'best long', 'best short / best avoid', and an optional 'Asset Divergence Monitor' for one asset or one ticker, which pushes the skill toward specific security-level directional recommendations rather than only macro environment judgment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The product-boundary section states that the human owns 'exact asset' selection, reinforcing a macro-first advisory role. Yet the later required outputs repeatedly ask the skill to determine 'Best Expression' and list 'best long' and 'best short', which contradict that boundary by shifting instrument-selection responsibility back to the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/market_panels.py (reported line 374)May include surrounding context.

python

"sort_order": "asc",
                }
            )
            url = f"https://api.stlouisfed.org/fred/series/observations?{params}"
            payload = json.loads(http_get(url))
            observations = payload.get("observations", [])
            out: list[tuple[int, float]] = []

Static analysis

No suspicious patterns detected.