Stock-Decision

• Analyzed: Apr 1, 2026, 7:51 AM
• Findings: 1
• Version: 1.0.1
• Hash: 9e328cfb8e4d3d13cd52df8889d71ff23098708af9365b928dc8ffbfce8e926b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a critical shell injection vulnerability in 'scripts/analyze.py' and 'scripts/backtest.py', where user-provided stock names or codes are passed directly into 'subprocess.run' with 'shell=True' without sanitization. While the scripts appear functionally dedicated to stock analysis and macro-economic research (including web scraping via 'requests' in 'scripts/macro_analyzer.py'), the insecure execution pattern allows for arbitrary command execution. No evidence of intentional malice, such as data exfiltration or persistence mechanisms, was observed.