Security audit

Stock Alert Workflow

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent stock and crypto analysis skill that stores local portfolio data and uses external market/news data sources, but it does not show hidden trading, credential theft, or exfiltration behavior.

Install only if you are comfortable storing portfolio quantities and cost basis locally and sending ticker lookups to external market/news providers. Review WhatsApp alert text before forwarding it, and use update, remove, and delete portfolio commands carefully because they change local saved records.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation includes destructive commands such as portfolio remove/delete without an explicit warning, confirmation requirement, or backup guidance. In an agentic context, terse command examples can be replayed or auto-completed by tooling, increasing the risk of unintended local data loss in the persisted portfolio file.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: Portfolio mode reads local holdings, quantities, and cost basis from the portfolio store without any explicit notice or consent flow at the time of access. In an agent-skill context, local financial holdings are sensitive personal data, so silent access increases privacy risk and can surprise users who only expect per-ticker analysis.

Static analysis

No suspicious patterns detected.