Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
tvscreener>=0.2.0 pandas>=2.0.0 pyyaml>=6.0 pytest>=7.0.0
- Confidence
- 93% confidence
- Finding
- tvscreener>=0.2.0
Security audit
TV Signal Screener
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed TradingView market screener that installs Python packages, fetches market data, and filters results locally without requesting account credentials or trading authority.
Install only if you are comfortable with a local Python virtual environment downloading the listed packages and with the skill contacting TradingView-related market data services. Prefer trusted signal YAML files, and consider pinning dependencies before use in a sensitive or reproducible environment.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
tvscreener>=0.2.0 pandas>=2.0.0 pyyaml>=6.0 pytest>=7.0.0
- Confidence
- 91% confidence
- Finding
- pandas>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
tvscreener>=0.2.0 pandas>=2.0.0 pyyaml>=6.0 pytest>=7.0.0
- Confidence
- 96% confidence
- Finding
- pyyaml>=6.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
tvscreener>=0.2.0 pandas>=2.0.0 pyyaml>=6.0 pytest>=7.0.0
- Confidence
- 88% confidence
- Finding
- pytest>=7.0.0
Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more
Critical
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
- pyyaml
Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)
Low
- Category
- Supply Chain
- Confidence
- 66% confidence
- Finding
- pytest
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/signal_types.py:92