avanza-investment-tracker

• Outcome: Pass
• Latest audit: Jul 25, 2026 · 6:54 PM UTC
• Version: 2.12.2

Overview

This is a disclosed local portfolio-tracking CLI that edits a user-chosen database and optionally contacts market-data services for prices and benchmarks.

Install only if you are comfortable storing financial transactions in a local SQLite database and letting optional price/risk features contact external services. Keep backups before using reset --hard, delete-tx, or account delete, and use update-prices never plus avoid risk/beta/benchmark options if you need offline-only processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation advertises commands that read and write local databases/CSV files and also fetch remote price data, yet it declares no permissions. That mismatch weakens user consent and sandbox enforcement because an agent may perform filesystem and network actions the user did not explicitly approve, which is especially sensitive for private financial records.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose frames the skill as CSV import and return calculation, but the documented behavior includes outbound requests to multiple third parties, destructive database mutation, account/portfolio restructuring, synthetic transfers, and richer reporting/risk analysis. This broader behavior increases the chance that a user or orchestrator will authorize the skill under false assumptions, leading to unexpected data exfiltration, irreversible portfolio-data changes, or unsafe automated actions on sensitive financial datasets.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill description focuses on processing CSV exports and calculating portfolio statistics, but this file also performs live market-data lookups and persists external results. That expands the trust boundary, sends portfolio-related asset identifiers to a third party, and introduces network-side availability/privacy risk not clearly implied by the stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code imports and uses requests for live external lookups unrelated to local CSV parsing alone, enabling network capability beyond a minimal offline portfolio-statistics tool. In skill contexts, unexpected outbound connectivity increases data disclosure and supply-chain exposure even if the immediate purpose is functional.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code loads an arbitrary local JSON file and turns its contents into transformation rules that can rewrite transaction fields before processing. If an attacker or untrusted local component can modify that file path or file contents, they can silently alter transaction semantics, causing integrity compromise of portfolio records, tax-relevant data, and performance calculations without any authentication or validation.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The code makes outbound HTTP requests to Riksbanken to fetch policy-rate data, which means local portfolio/CSV processing is not purely offline as the skill description suggests. Even if the transmitted data is limited to date ranges, this still introduces undisclosed network dependency, metadata leakage, and reliance on third-party availability for a finance tool users may expect to run locally.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill fetches both risk-free rate data and benchmark prices from external services (Riksbanken and Yahoo Finance), expanding its capability beyond local CSV import and portfolio tracking. This creates privacy and integrity risks because user-selected tickers and analysis date windows are exposed to third parties, and portfolio metrics become dependent on untrusted external data sources.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow documentation includes a destructive `reset --hard` command that deletes transactions, stats, and prices, but it does not provide any explicit warning, backup guidance, or confirmation expectations. In a finance/portfolio-tracking skill, accidental invocation can cause irreversible loss of user data and operational disruption even if the command is not malicious.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code unconditionally drops existing cached tables during initialization/migration logic with no user confirmation or safety check. In a skill environment, unexpected destructive database operations can cause integrity and availability issues, especially if run automatically or against the wrong database file.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The function sends asset symbols and FX queries to an external service without any visible consent, notice, or privacy boundary in the code path. While the transmitted data is limited, portfolio holdings can still be sensitive financial metadata in this skill context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Running the module as a script immediately updates prices from the network and writes computed results to the database. That creates side effects without an explicit prompt or dry-run mode, which is risky for agent-driven execution and can alter user data unexpectedly.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The reset_table and reset_tables methods perform unconditional DELETE operations across arbitrary or all tables with no confirmation, authorization guard, or safety interlock. In a portfolio-tracking skill that stores financial transaction history, accidental invocation, misuse by higher-level agent logic, or prompt-induced tool abuse could irreversibly erase investment records and corrupt reporting.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: External HTTP requests occur silently with no user-facing warning, so users may unknowingly reveal financial-analysis metadata such as benchmark tickers and time ranges. In a portfolio tool, hidden network activity undermines informed consent and can violate expectations of local-only processing even if no credentials are directly transmitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

if currency in fx_rates:
                return fx_rates[currency]
            try:
                r = requests.post(url, headers=headers, timeout=10, json={
                    "query": f"{currency}/SEK",
                    "searchFilter": {"types": ["INDEX"]},
                    "pagination": {"from": 0, "size": 1},

• Confidence: 91% confidence
• Finding: requests.post(url, headers=headers, timeout=10, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

return None

        for (asset,asset_id) in assets:
            r = requests.post(url, headers=headers, json={"query": asset, "limit": 5}, timeout=10)
            time.sleep(0.05)

            if r.status_code == 200:

• Confidence: 92% confidence
• Finding: requests.post(url, headers=headers, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

# range so subsequent sub-range requests still hit the cache.
    fetch_from = from_date if cached_from is None else min(from_date, cached_from)
    fetch_to = to_date if cached_to is None else max(to_date, cached_to)
    url = f"https://api.riksbank.se/swea/v1/Observations/SECBREPOEFF/{fetch_from.isoformat()}/{fetch_to.isoformat()}"
    headers = {
        "User-Agent": (
            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "

• Confidence: 88% confidence
• Finding: https://api.riksbank.se/

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests

• Confidence: 97% confidence
• Finding: requests

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: requests

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.