Security audit
Tecent Finance 1
Security checks across malware telemetry and agentic risk
Overview
The reviewed package is a documentation-only stock quote helper with disclosed Tencent Finance network use and no included executable code or hidden behavior.
This appears safe as reviewed, but install only after verifying the actual tfin executable or source if you obtain it elsewhere. Expect queried stock symbols to be sent to Tencent Finance, and create the optional global symlink only for an executable you trust.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.