Security audit

super-stock-analysis

Security checks across malware telemetry and agentic risk

Overview

This stock-analysis skill mostly matches its market-analysis purpose, but it ships an unrelated self-rewriting script and uses risky Twitter/X session-cookie handling.

Install only if you are comfortable with a finance skill that contacts several external data providers and stores portfolio/watchlist data locally. Avoid using the optional Twitter/X setup unless you understand that auth_token and ct0 are live session credentials; do not grant broad disk access or place valuable account cookies in .env for an external CLI. The bundled batch_refactor.py should not be run in normal use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises substantial capabilities including shell execution, network access, and persistent file reads/writes, but does not declare permissions or clearly bound those actions. This creates a trust and review gap: users and the hosting agent may invoke a skill that can modify local state and access external resources without explicit consent or visibility.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is market analysis, but the finding indicates additional behaviors such as batch source-code rewriting, delayed local file modification, and use of extra external data/scraping tools beyond the stated Yahoo Finance basis. Hidden or mismatched behavior is dangerous because it can mask unauthorized code tampering or unexpected data exfiltration behind a benign financial-analysis facade.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The README presents the skill as Yahoo Finance-based, but the documented behavior materially expands to multiple third-party sources including Google News, CoinGecko, SEC EDGAR, and optional Twitter/X access via external tooling and local auth tokens. This creates a security and privacy transparency problem because users may grant trust based on a narrower stated scope than the skill actually requires, increasing the risk of unintended data exposure or broader network access.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation explicitly says the skill produces clear BUY/HOLD/SELL signals while elsewhere trying to distance itself from being a source of trading signals. That contradiction can mislead users and downstream agents into treating the output as actionable financial advice without appropriate safeguards, which is especially risky in a finance skill where users may act on recommendations immediately.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The file says the tool advises and does not execute, but also denies being trading signals despite repeatedly describing signal-like outputs. While not a direct code-execution issue, this inconsistency can create unsafe reliance and weakens user understanding of what the system actually does, increasing the chance of misuse in an investment context.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documentation expands the skill from passive market analysis into acquiring and using Twitter/X authentication material, including manual cookie extraction and use of a third-party CLI. In a skill whose stated purpose is stock/crypto analysis, instructing users to collect auth tokens and grant elevated local access creates unnecessary credential-handling risk and could expose sensitive session data if the environment or tooling is compromised.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill metadata emphasizes Yahoo Finance data, but this document describes aggregating CoinGecko, Google News, and Twitter/X as additional inputs. This scope expansion is security-relevant because it increases external data ingress, dependencies, and behavioral surface beyond what a user might reasonably expect from the manifest, reducing transparency and informed consent.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This script enumerates and rewrites local Python source files, which is unrelated to the declared stock and cryptocurrency analysis capability. In an agent skill context, hidden source-modification functionality expands the attack surface and could enable unauthorized tampering with the skill codebase or adjacent files if invoked, especially because it performs bulk edits automatically after only a short delay.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code performs codebase-wide rewriting of Python files and then auto-executes the changes after a 3-second delay, which is not justified by the skill's financial-analysis purpose. This is dangerous because it gives the skill an internal self-modification/tampering capability that could alter logic, introduce persistence, or damage integrity of the local repository without meaningful operator review.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code loads all key/value pairs from a local .env file into process environment variables and then later forwards the entire environment to an external third-party CLI. That unnecessarily broad credential exposure expands the trust boundary and can leak secrets such as API tokens to tooling that does not need them.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The scanner invokes a local external executable (`bird`) to fetch Twitter/X data and explicitly passes a copied full environment into that subprocess. That broadens the trust boundary beyond ordinary HTTP fetching and can expose secrets from `.env` or process environment variables to the child process, which is not necessary for general market-trend analysis.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill description emphasizes Yahoo Finance analysis, but this file also contacts CoinGecko, Google News, Reddit, and Twitter/X. This scope expansion increases data egress, third-party dependency risk, and surprise behavior for users who would not expect the skill to reach multiple external services.

Intent-Code Divergence

Low

Confidence: 73% confidence
Finding: The documentation presents Twitter/X support as a normal built-in feature, but the implementation actually shells out to a local `bird` binary. This is risky because users and reviewers may not realize execution depends on a separate executable with its own behavior, permissions, and credential handling.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The roadmap explicitly plans third-party push notifications, analytics, and error tracking, but it does not pair those data flows with user notice, consent, or minimization requirements. In a finance app, telemetry and notification payloads can reveal portfolio holdings, watchlists, device identifiers, and behavior patterns, creating meaningful privacy and compliance risk even if the omission is only in planning documentation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README instructs users to extract browser authentication cookies for Twitter/X and place them into a local .env file, but does not adequately warn that these values are effectively bearer credentials that can enable account access if leaked. This is dangerous because users may mishandle, commit, share, or expose these tokens through logs, shell history, backups, or other local compromise paths.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The manifest description is very broad, encouraging use across many loosely defined scenarios such as trend detection, rumors, and early signals, without clear trigger boundaries. Overbroad invocation language increases the chance the agent will route unrelated prompts into a skill with shell, network, and file-writing capability, expanding exposure unnecessarily.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The documentation describes creating portfolios, adding holdings, and managing watchlists stored under the user's home directory, but it does not prominently warn that running these commands will persist and modify local files. Silent persistence is risky because users may unknowingly create or overwrite local data, and a compromised or misused skill could leverage that write path for unwanted state changes.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document introduces BUY/HOLD/SELL recommendations early without an equally prominent warning that users may construe them as personalized or actionable investment advice. In the context of a stock-analysis skill, that increases the likelihood of harmful overreliance, regulatory exposure, and unsafe agent behavior if other systems consume these outputs as authoritative decisions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation tells users to grant Terminal Full Disk Access and manually extract and store browser-derived auth cookies without accompanying safety guidance. Those steps materially increase the chance of credential theft, over-privileged local access, and accidental leakage of long-lived session tokens through shell history, files, logs, or other tools.

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: The script makes numerous outbound network calls to third-party services including Yahoo Finance, Google News RSS, SEC EDGAR, and Fear & Greed sources, but its comments and docstrings do not clearly disclose this breadth of data sharing and external dependency behavior. In an agent skill context, hidden external requests are risky because users may expect local analysis while the skill silently transmits queried tickers, portfolio contents, and usage patterns to outside providers.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Sensitive environment variables are loaded from .env without scoping and are later exposed to a subprocess without any user notice or consent flow. This increases the chance of accidental credential disclosure to third-party components and obscures data-handling behavior from the operator.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.