Yahoo Finance News

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.1

Overview

This skill fetches Yahoo Finance headlines for requested symbols and stores a small local cache; its main issue is broad wording that could make an agent choose it too often.

Install this if you are comfortable with pip installing yfinance, sending requested ticker symbols to Yahoo Finance through that library, and keeping cached public headline results locally. Agents should use it only for explicit ticker or Yahoo Finance news requests, not broad general-news questions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to capture generic financial-news queries, which can cause the agent to invoke this skill outside its intended symbol-specific scope. That increases the chance of inappropriate tool activation, unnecessary network calls, and misleading responses when user intent is broader than Yahoo-symbol headline retrieval.

VirusTotal

66/66 vendors flagged this skill as clean.