stock-direction-signals

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about buying stock-research data with a MetaMask wallet, but it asks users to install and run mutable external wallet-adjacent code before spending real USDC.

Review this carefully before installing. Use a dedicated low-balance wallet, dry-run first, verify the exact upstream code you are about to execute, pin dependencies or commits where possible, and keep funding limits conservative. Do not approve wallet actions unless the address, network, token, amount, and quoted total match what you expected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:65

Finding

Unpinned External Dependencies Enable Supply-Chain Code Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-70
Vulnerability Type: Unpinned and mutable executable dependencies
Risk Level: High

Vulnerable Code

bash

mm --version || npm install -g @metamask/agent-wallet@latest
npx skills add SELAT-AI/selat-metamask-skills

The retrieved project is subsequently trusted as the source of executable scripts:

bash

python3 skills/selat-purchasing/scripts/run_manifest.py \
  skills/stock-direction-signals/manifest.json \
  --param ticker=NVDA --dry-run

bash

python3 skills/selat-purchasing/scripts/eco_fund.py <usdc-amount>

The document itself states that the upstream project is not hardened:

The upstream repo is a prototype from a live 2026-08 integration spike — proven on mainnet, not yet hardened; review before large budgets.

Technical Analysis

The Skill installs @metamask/agent-wallet@latest globally and retrieves a GitHub-hosted Skill repository without pinning either dependency to a reviewed immutable version or commit. No checksum, package signature, lockfile, or source-integrity verification is specified.

The effective implementation is not contained in the audited artifact. After retrieval, Python scripts from the mutable upstream repository are executed for manifest processing, wallet funding, paid purchases, and spending reports. Consequently, the behavior reviewed in SKILL.md can differ from the behavior executed later if the npm release, GitHub branch, repository account, package publication process, or dependency-resolution infrastructure changes or is compromised.

Although the document claims that the upstream scripts do not access key material and that signatures remain in the wallet CLI, those claims cannot be independently verified from this artifact because the relevant scripts and manifest are absent.

Attack Path

1. An attacker compromises the npm package, its publisher account, the ...[truncated 1757 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version. Use a lockfile and verify npm registry integrity metadata before installation.
2. Pin the GitHub dependency to a reviewed immutable commit hash rather than a mutable branch or repository default.
3. Verify downloaded artifacts using published cryptographic hashes or signed release attestations before executing them.
4. Vendor the required manifest and Python scripts into the Skill package so that the audited implementation is the implementation that runs.
5. Audit all retrieved scripts, including run_manifest.py, eco_fund.py, and spend_report.py, before authorizing wallet funding or paid execution.
6. Avoid global package installation where possible. Run the tooling in a dedicated, minimally privileged environment with restricted filesystem and network access.
7. Require explicit user confirmation after displaying the exact wallet address, network, transaction recipient, token, amount, per-step prices, total cost, and immutable dependency versions.
8. Independently enforce wallet-level allowlists and conservative spending limits rather than relying exclusively on controls implemented by downloaded scripts.
9. Revalidate expired quotes and reject any transaction whose signed parameters differ from the values previously shown to the user.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to execute npx skills add SELAT-AI/selat-metamask-skills without pinning an exact package version or commit. This creates a supply-chain risk: a future malicious or compromised skills package release, or changed upstream repository state, could cause users to fetch and run unexpected code in a workflow that later interacts with a funded wallet and payment tooling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.