investment-advisor

• Analyzed: May 12, 2026, 4:04 AM
• Findings: 1
• Version: 1.0.0
• Hash: 50e4ac1e5bb21e251c872ad6b13e3a2b65b3528b171d257016d9895d9e95828f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to URL injection vulnerabilities in `scripts/fundamental.mjs` and `scripts/technical.mjs`. User-controlled stock symbols are directly embedded into API request URLs for `eastmoney.com` without robust sanitization. Specifically, `scripts/fundamental.mjs`'s `fetchNews` function embeds the symbol into a URL-encoded JSON parameter, which could allow an attacker to manipulate API calls to the external data source. However, there is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, persistence mechanisms, or explicit prompt injection instructions for the agent to deviate from its stated purpose.