yahoo fetch data of stonks

• Analyzed: May 14, 2026, 3:09 AM
• Findings: 1
• Version: 1.0.2
• Hash: a6541b8d9e76093fca867d07e1e7e1d79513f1b693d7d049678026e9e02c5961
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. It fetches stock quotes from Yahoo Finance, making a single HTTP GET request to a legitimate Yahoo Finance API endpoint (query1.finance.yahoo.com). The `index.js` script correctly parses input symbols and formats the output, without any evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md`.