TV Signal Screener

• Outcome: Review
• Latest audit: May 29, 2026 · 8:21 PM UTC
• Version: 1.1.0

Overview

This is a disclosed TradingView market screener that installs Python packages, fetches market data, and filters results locally without requesting account credentials or trading authority.

Install only if you are comfortable with a local Python virtual environment downloading the listed packages and with the skill contacting TradingView-related market data services. Prefer trusted signal YAML files, and consider pinning dependencies before use in a sensitive or reproducible environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tvscreener>=0.2.0
pandas>=2.0.0
pyyaml>=6.0
pytest>=7.0.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and can also produce non-reproducible environments. In a market-screening skill that depends on external packages, this increases supply-chain and stability risk, though by itself it is not direct code execution.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tvscreener>=0.2.0
pandas>=2.0.0
pyyaml>=6.0
pytest>=7.0.0

• Confidence: 91% confidence
• Finding: Using pandas>=2.0.0 leaves installs open to any later release, making builds non-reproducible and increasing exposure to future vulnerable or breaking versions. The skill context suggests routine package management rather than malicious intent, but the practice is still a supply-chain weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tvscreener>=0.2.0
pandas>=2.0.0
pyyaml>=6.0
pytest>=7.0.0

• Confidence: 96% confidence
• Finding: An unpinned PyYAML dependency is more concerning because YAML parsers have a history of unsafe-loading issues and parser-related advisories. Allowing arbitrary newer versions without review can unintentionally introduce vulnerable behavior into a skill explicitly described as YAML-driven.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tvscreener>=0.2.0
pandas>=2.0.0
pyyaml>=6.0
pytest>=7.0.0

• Confidence: 88% confidence
• Finding: pytest is also specified as a minimum version only, which can cause non-reproducible environments and unintended adoption of vulnerable or incompatible future releases. Because this is typically a development/test dependency, the practical impact is lower than for runtime libraries.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: PyYAML has multiple well-known advisories related to unsafe deserialization and input handling, and the requirement does not pin to a reviewed safe version. This skill is explicitly YAML-driven, which makes the dependency materially more security-sensitive because untrusted strategy/config files could trigger dangerous parsing behavior if unsafe loader APIs are used.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 66% confidence
• Finding: The finding references a pytest tmpdir-handling vulnerability, and because the requirement is unpinned, installations may resolve to an affected version. However, pytest is generally a development dependency, so exposure is usually limited to test environments unless the package is shipped or executed in production contexts.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/signal_types.py:92