Stock TA Charts

• Outcome: Review
• Latest audit: May 29, 2026, 9:24 PM
• Version:
  1.0.0

Overview

The skill is mostly a chart generator, but it also tells the agent to send generated chart images to a fixed Telegram recipient without user-selected destination or confirmation.

Review before installing. Use the chart generation only with a trusted local crypto_charts.py file, and remove or replace the hard-coded Telegram target before allowing the agent to send any chart image externally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs sending generated chart images to a hard-coded Telegram target, which can cause unintended exfiltration of user-requested outputs or locally generated artifacts to an external recipient without user confirmation. Even though chart images are not inherently sensitive, embedding a fixed recipient in the skill creates a dangerous data-flow pattern and normalizes outbound sharing without privacy checks or consent.

VirusTotal

66/66 vendors flagged this skill as clean.