Finnhub Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 0.2.0

Overview

This skill is a disclosed read-only Finnhub market-data helper that uses an API key only to query Finnhub and does not modify accounts or persist data.

Install only if you are comfortable giving the agent access to your Finnhub API key for read-only market-data requests. Review the broad activation wording and Chinese daily-report template if language or routing precision matters to your workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 48, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/finnhub.py (reported line 50)May include surrounding context.

python

url = f"{base_url}{path}?{urllib.parse.urlencode(params)}"
    req = urllib.request.Request(url, headers={"User-Agent": "finnhub-skill/0.2"})
    try:
        with urllib.request.urlopen(req, timeout=20) as resp:
            body = resp.read().decode("utf-8")
            return json.loads(body)
    except urllib.error.HTTPError as e:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The implementation is broadly consistent with the declared read-only Finnhub market-data purpose: it only performs HTTPS GET requests to official Finnhub hosts, uses an API key, and exposes commands for quote, candles, profile, news, earnings, and economic calendar retrieval. However, the description explicitly says the skill should be used for stock, forex, and crypto data, while the supplied code only implements stock-oriented quote/candle/profile/news plus earnings and economic calendar endpoints. There are no commands or endpoint coverage specifically for forex or crypto market data. This makes the description somewhat broader than the actual behavior. No undeclared sensitive or write capabilities were found.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a bundled Python script, depends on environment variables, and is intended to make live network requests, but it does not declare an explicit tool/permission scope. That creates an authorization and review gap: an orchestrator or reviewer cannot easily enforce that the skill should only use env access for FINNHUB_API_KEY and outbound network access to Finnhub, increasing the risk of unintended tool use or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation description is broad enough that the skill could trigger on incidental mentions of Finnhub API, tokens, or workflow packaging rather than a clear user request for market-data retrieval. Over-triggering can expose secrets handling paths, cause unnecessary external requests, or route user prompts into a capability that reads environment configuration and performs network access when not actually needed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The report structure uses Chinese section headings and content labels throughout the template, which imposes a specific language on outputs. The file does not indicate that Chinese is optional or user-selected, so this appears to violate the policy against forcing a language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The daily stock report section gives example user requests entirely in Chinese alongside an implied reporting workflow, but the document does not say that output language should follow the user's preference or be chosen explicitly. This can create an unintended language/locale constraint in skill behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.