Finance Watcher

• Analyzed: May 14, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9cadd4c2399d852b333cc9f8f471738dc926bd67fe1f5888a36fe6dae0f72954
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'finance-watcher' skill is generally benign, performing its stated functions of monitoring stock and cryptocurrency prices, setting alerts, and generating reports. However, it contains a significant vulnerability in `bin/finance-watcher.js`. The `report` command allows writing the generated markdown report to an arbitrary file path specified by the user via the `--output <file>` option. This lack of path sanitization could allow an attacker or a confused AI agent to overwrite sensitive system or user files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) with the report content, leading to data loss or system instability. While the content written is not inherently malicious, this arbitrary file write capability represents a critical vulnerability.