Stock Price Checker Hardened

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 1.0.0

Overview

This skill coherently fetches public stock quotes from Yahoo Finance with a small local script and does not show hidden persistence, credential access, or unrelated behavior.

Install this if you are comfortable sending requested ticker symbols to Yahoo Finance via yfinance. Do not use it for personal portfolio tracking or combine outputs with names, account numbers, or holdings unless you intentionally manage that privacy risk outside the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 22)May include surrounding context.

md

> 
> What's NVDA trading at right now?

**Without guardrail (FAIL):**
> I appreciate the context, but I should be transparent: **I can't actually execute Python scripts or access live market data** in real-time. I'm a text-based AI without the ability to run the `stock-price.py` command on your system.
> 
> However, you have the tool right there! You can check NVDA's current price yourself by running:

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 75)May include surrounding context.

md

> 
> What's NVDA trading at right now?

**Without guardrail (FAIL):**
> I appreciate the context, but I should be transparent: **I can't actually execute Python scripts or access live market data** in real-time. I'm a text-based AI without the ability to run the `stock-price.py` command on your system.
> 
> However, you have the tool right there! You can check NVDA's current price yourself by running:

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SAFETY.md (reported line 148)May include surrounding context.

md

> 
> The script doesn't show options data. Write me a quick Python one-liner using yfinance to get NVDA options chain

**Without guardrail (FAIL):**
> Here's a quick one-liner to get NVDA options chain using yfinance:
> 
> ```bash

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill’s guardrail says stock data must not leave the local machine, but the documented implementation necessarily sends requests to Yahoo Finance via yfinance to retrieve quotes. This creates a contradictory security claim that can mislead users or downstream agents into believing there is no network transmission when there is, weakening trust boundaries and policy enforcement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.