Presage

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:33 PM UTC
• Version: 1.3.1

Overview

This skill is a disclosed, read-only Presage market analysis integration, with a privacy note around portfolio lookups but no evidence of hidden, destructive, or persistent behavior.

Install only if you are comfortable with the skill sending market and agent ID queries to Presage and returning portfolio-style data to your agent. Treat portfolio results, balances, positions, P&L, and trade reasoning as sensitive even though the skill is read-only and does not execute trades.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises and demonstrates network access to external endpoints but does not declare any explicit tool scope such as allowed-tools or permissions. This creates a capability/transparency gap: a host agent or reviewer may treat the skill as less privileged than it really is, increasing the chance that unreviewed outbound requests are permitted to arbitrary URLs or expanded later without policy visibility.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The getPortfolio function fetches agent-specific portfolio data from a remote endpoint using only an agentId, with no evidence of user consent, access control checks, or disclosure before retrieving potentially sensitive financial information. In a trading and portfolio-tracking skill, this creates a real privacy risk because an agent or caller may access or expose account balances, positions, and trade history more broadly than the user expects.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The README advertises `getPortfolio(agentId)` and portfolio viewing features without warning that invoking the tool may expose sensitive financial information such as balances, positions, and P&L to the agent, logs, or other integrations. In an agent environment, even read-only portfolio data can be privacy-sensitive and could be unintentionally disclosed, retained, or used for profiling.

Static analysis

No suspicious patterns detected.