US Stock Analyzer

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:04 PM UTC
• Version: 1.0.0

Overview

It appears to be a normal stock-analysis skill, with practical cautions around investment advice, dependency pinning, and API-key handling.

Install this only in a virtual environment, prefer FMP_API_KEY over putting a real key in config.yaml, avoid committing local config files, and treat all BUY, sizing, target, and stop-loss outputs as screening information that needs independent review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/data_fetcher.py:108

Finding

FMP API Key May Be Exposed Through Plaintext Configuration and URL Query Parameters

Content

View full analysis

Dict: """Fetch financial statements from FMP API.""" if not self.fmp_key: return {} endpoints = { "income": f"{self.fmp_base}/income-statement/{ticker}", "balance": f"{self.fmp_base}/balance-sheet-statement/{ticker}", "cashflow": f"{self.fmp_base}/cash-flow-statement/{ticker}", "ratios": f"{self.fmp_base}/ratios-ttm/{ticker}" } results = {} for name, url in endpoints.items(): try: resp = requests.get(f"{url}?apikey={self.fmp_key}", timeout=30) resp.raise_for_status() results[name] = resp.json() except Exception as e: results[name] = {"error": str(e)} return results ``` ### Technical Analysis The checked-in value is only a placeholder and is not itself a leaked credential. However, the configuration comments ...[truncated 2564 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Future Package Versions

Content

View full analysis

=0.2.0 requests>=2.28.0 # Data processing pandas>=1.5.0 numpy>=1.21.0 # Visualization matplotlib>=3.5.0 # Configuration pyyaml>=6.0 ``` `SKILL.md:44-45`: ```bash # Install dependencies pip3 install yfinance pandas numpy matplotlib pyyaml requests ``` ### Technical Analysis The requirements use open-ended lower bounds, while the documented installation command provides no version constraints at all. Consequently, separate installations can resolve different direct and transitive package versions. A future package release can be installed without having been reviewed alongside this Skill. The package names are conventional and the audit found no custom package index, typo-squatted name, direct URL dependency, or known malicious package embedded in the project. The risk is therefore prospective supply-chain exposure and reproducibility failure rather than evidence that a currently listed dependency is malicious. Python package installation and import can execute package-controlled code with the privileges of the user or Agent environment. Exact dependency resolution and integrity verification are particularly important when a Skill is installed automatically. ### Attack Path 1. A user or Agent follows `SKILL.md` or installs from `requirements.txt`. 2. The package resolver contacts the configured Python package index and selects the newest versions satisfying the broad constraints, including transitive dependencies. 3. A compromised upstream release, maliciously replaced distribution, or unexpectedly incompatible future version is selected. 4. Package-controlled code executes during installation, import, or normal Skill operation. ...[truncated 948 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The reported behavior mismatch suggests the skill may present technical analysis as if it were a broader value-plus-sentiment framework. In this context, that is especially risky because the skill is explicitly intended to influence investment actions, so overstated capabilities can directly affect user decisions and reduce scrutiny of the actual logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The reported behavior mismatch suggests the skill may present technical analysis as if it were a broader value-plus-sentiment framework. In this context, that is especially risky because the skill is explicitly intended to influence investment actions, so overstated capabilities can directly affect user decisions and reduce scrutiny of the actual logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The reported behavior mismatch suggests the skill may present technical analysis as if it were a broader value-plus-sentiment framework. In this context, that is especially risky because the skill is explicitly intended to influence investment actions, so overstated capabilities can directly affect user decisions and reduce scrutiny of the actual logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The reported behavior mismatch suggests the skill may present technical analysis as if it were a broader value-plus-sentiment framework. In this context, that is especially risky because the skill is explicitly intended to influence investment actions, so overstated capabilities can directly affect user decisions and reduce scrutiny of the actual logic.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares environment-variable, package-installation, and network-related capabilities but does not define an explicit tool scope such as allowed-tools or permissions. That creates unnecessary ambiguity about what the skill may access at runtime, increasing the chance that a host agent grants broader file, network, or environment access than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The report presents a clear BUY signal and recommends a 10% portfolio allocation before any prominent risk warning, which can materially influence user financial decisions. In an investment-analysis skill, concrete trade instructions, entry points, stops, and sizing increase the chance that users treat the output as actionable advice despite the later disclaimer.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a stock analysis skill that combines DCF, trend, and VIX sentiment signals. While fetching market data is expected, directly reading credentials from process environment introduces a broader secret-access capability that is not stated in the manifest and is not necessary to describe at the skill-intent level.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest promises stock analysis and buy-signal generation, but this file also persists artifacts to arbitrary user-supplied paths via chart saving and CLI JSON export. Local file creation is not mentioned as part of the skill's purpose and expands the capability beyond pure analysis/report generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a real issue: the module generates explicit trading-oriented outputs such as a buy signal, risk assessment, and position sizing guidance, but does not present any disclaimer or user-facing warning that the output is informational only and not financial advice. In the context of an investment-analysis skill, users may over-trust these recommendations and act on them as actionable advice, increasing the risk of financial harm if the model or data is wrong, stale, or incomplete.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with only a lower bound, so builds can resolve to different future versions over time. This weakens supply-chain reproducibility and makes it harder to verify whether a deployed environment includes a vulnerable or breaking release.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# US Stock Analyzer Dependencies

# Data fetching
yfinance>=0.2.0
requests>=2.28.0

# Data processing

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using requests with only a minimum version allows uncontrolled upgrades and non-reproducible installs. Because requests has a history of advisories, the lack of exact pinning makes it difficult to ensure deployments consistently avoid affected versions.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Data fetching
yfinance>=0.2.0
requests>=2.28.0

# Data processing
pandas>=1.5.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest does not pin requests, so even though known advisories exist, there is no way to verify whether resolved installations are affected. This is a real supply-chain risk because insecure versions may be pulled in silently depending on install time and resolver behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

An unpinned pandas dependency means the environment may install different versions at different times, which creates reproducibility and supply-chain assurance problems. This is especially relevant where historical advisories exist and version provenance matters for security review.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text

requests>=2.28.0

# Data processing
pandas>=1.5.0
numpy>=1.21.0

# Visualization

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because pandas is not pinned, the project cannot demonstrate whether installed versions are impacted by known advisories. The risk is primarily uncertainty and poor attestability rather than immediate proof of exploitation from this file alone.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Specifying numpy with only a lower bound permits future versions to be installed without review, reducing build determinism. In a supply-chain context, this increases uncertainty around whether the resolved package version is secure and compatible.

Content

Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.

text

# Data processing
pandas>=1.5.0
numpy>=1.21.0

# Visualization
matplotlib>=3.5.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

NumPy has known advisories, but the absence of exact version pinning prevents verification that deployed instances avoid affected releases. This creates a supply-chain assurance gap and can expose some environments to vulnerable versions unintentionally.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

An unpinned matplotlib dependency introduces non-deterministic dependency resolution and weakens software supply-chain control. While not directly exploitable on its own, it increases operational and security uncertainty across environments.

Content

Scanner excerpt · requirements.txt (reported line 12)May include surrounding context.

text

numpy>=1.21.0

# Visualization
matplotlib>=3.5.0

# Configuration
pyyaml>=6.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

PyYAML has a history of unsafe-deserialization-related advisories, and leaving it unpinned makes it impossible to know whether installs will resolve to a safe release. In a skill that may ingest configuration or analysis inputs, that uncertainty is more concerning than for purely inert libraries.

Content

Scanner excerpt · requirements.txt (reported line 15)May include surrounding context.

text

matplotlib>=3.5.0

# Configuration
pyyaml>=6.0

# Optional: For enhanced data
# fmp-python>=0.1.0  # Financial Modeling Prep SDK

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

PyYAML has several notable security advisories related to unsafe parsing behavior, and without version pinning the project cannot prove it avoids affected releases. Given YAML libraries are often used on semi-trusted configuration data, this uncertainty is more dangerous than for many other dependencies.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a stock-analysis skill that generates buy signals from market and sentiment data, which clearly justifies fetching remote financial data. However, the standalone CLI also supports writing results to a user-specified local file, a persistence capability not indicated by the stated purpose of analysis itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code accesses a sensitive credential via the FMP_API_KEY environment variable. Although the module docstring mentions API keys in config, there is no explicit runtime warning, log message, or user-facing disclosure that environment-based credentials are being consumed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.