Security audit

All Market Data, One API Key

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed SentiSense market-data skill bundle with local report-generation features, and I found no evidence of trading, wallet access, destructive behavior, or hidden execution.

Install only if you are comfortable giving the agent a SentiSense API key for read-only market-data calls. Ask the agent to use personalized insights only when you explicitly want watchlist or portfolio-linked output, and expect dashboard/calculator skills to create local HTML files or pinned widgets when requested. Financial outputs are research context, not trading instructions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is described broadly as a read-only market data API, but it also documents an authenticated `/api/v1/insights/user` endpoint that returns personalized insights derived from the authenticated user's watchlist and portfolio. Even without write capability, this expands the data-access scope into potentially sensitive user-specific financial data, which can surprise an agent or user who expected only generic public market data.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill advertises 'No write operations' in its description, but the body explicitly instructs the agent to write an HTML file and optionally persist/replace an inline widget. This mismatch can mislead users, policy engines, or reviewers about the skill’s actual side effects, causing it to be granted in contexts where file or UI state modification is not expected.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documented personalized insights endpoint accesses watchlist and portfolio-derived data that is not implied by the headline description of a stock data API. In an agent setting, this can lead to inadvertent collection, exposure, or overuse of private financial preference data when the user only intended retrieval of public stock information.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The documentation is internally contradictory: the manifest says there are no write operations, while the permissions and instructions require writing an HTML file. In security-sensitive environments, such contradictions undermine trust boundaries and can bypass user expectations or automated allow/deny decisions that rely on manifest claims.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The public command trigger "<TICKER>" is a catch-all single-token pattern that can unintentionally activate the skill on ordinary one-word user input. In an agent environment, that ambiguity can cause unexpected market-data fetches, context hijacking, or misrouting away from the user's actual intent, especially when many skills compete for activation.

Natural-Language Policy Violations

Low

Confidence: 91% confidence
Finding: The page formats currency and numbers with the fixed locale "en-US" in user-facing output, which forces a specific language/locale presentation. The file does not offer a locale choice or explain why U.S. formatting is required, so this is a natural-language policy concern under the locale rule.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill explicitly tells the agent that cross-source agreement is a 'high-conviction read,' which nudges the model toward stronger investment-oriented interpretation than the underlying data supports. Even though the skill is read-only, this language can bias outputs into quasi-recommendations and overstate confidence from lagged, non-real-time 13F data.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The workflow says agreement across sources is 'the read worth surfacing,' which instructs the agent to prioritize a suggestive investment narrative rather than merely report data. In context, this is risky because it can transform informational holdings data into actionable-seeming financial guidance despite the document's disclaimer that the skill is not for advice.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: } legend.style.display = ""; var rText = sized.rMultiple === null ? "n/a" : sized.rMultiple.toFixed(2) + "R"; results.innerHTML = statHtml("Shares", count(sized.shares), (STATE.isLong ? "bought at " : "sold short at ") + money(STATE.entry)) +
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/expected-move-visualizer/scripts/prepare_data.mjs:18
Evidence: const KEY = process.env.SENTISENSE_API_KEY;

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/options-payoff-calculator/scripts/prepare_data.mjs:24
Evidence: const KEY = process.env.SENTISENSE_API_KEY;

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: skills/position-size-calculator/scripts/prepare_data.mjs:26
Evidence: const KEY = process.env.SENTISENSE_API_KEY;