Stock Alert (WhatsApp)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stock-alert purpose, but its WhatsApp recipient restrictions are documented and then not enforced, so it needs review before installation.

Install only after reviewing and tightening the send path: do not rely on the bundled WhatsApp constraints until the code enforces them, pin or lock dependencies, use a dedicated WhatsApp account/session for alerts, and remove or explicitly configure the Feishu/Lark document workflow if you do not intend that extra data flow.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: stock_alert_workflow.py:40

Finding

WhatsApp Recipient Access-Control Policy Is Not Enforced

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Make Installation Non-Reproducible

Content

View full analysis

=0.2.37 pandas>=2.2.0 pyyaml>=6.0.1 ``` `SKILL.md` installs those dependencies and an npm CLI without an exact reviewed version: ```yaml "install": [ { "id": "pydeps", "kind": "shell", "command": "pip install -r requirements.txt", "label": "Install Python deps (yfinance, pandas, pyyaml)" }, { "id": "wacli", "kind": "node", "package": "@ibrahimwithi/wu-cli", "bins": ["wu"], "label": "Install WhatsApp CLI (wacli) — optional, for sending" } ] ``` ### Technical Analysis The Python dependencies use lower-bound constraints rather than exact versions, and no lockfile or integrity hashes are provided. Consequently, two installations at different times may resolve to different package versions and transitive dependency graphs. The npm package `@ibrahimwithi/wu-cli` is also specified without an exact version or integrity information. This component is particularly sensitive because the workflow invokes its `wu` executable and relies on it to access an authenticated WhatsApp session. There is no evidence in the audited files that any current dependency is malicious. The confirmed weakness is that installation is mutable and does not cryptographically bind the environment to the versions reviewed during the audit. A compromised account, malicious future release, dependency confusion affecting a transitive package, or registry compromise could therefore introduce code outside the audited artifact. ### Attack Path 1. A user or deployment system follows the installation metadata. 2. `pip install -r requirements.txt` resolves the newest versions satisfying each `>=` constraint, including their c ...[truncated 1303 chars]

Remediation

View remediation

=`. 2. Generate and commit a lockfile that captures all transitive dependencies for supported environments. 3. Use cryptographic hashes for Python artifacts, such as a hash-locked requirements file installed with: ```bash pip install --require-hashes -r requirements.lock ``` 4. Pin `@ibrahimwithi/wu-cli` to an exact reviewed version and preserve the package-lock integrity value. 5. Install only from explicitly configured trusted registries, and prevent fallback to untrusted package indexes. 6. Review package provenance, maintainer ownership, release history, and published artifact integrity before updating versions. 7. Perform dependency updates through a controlled review process with automated vulnerability scanning and tests. 8. Run the workflow and package installation under a dedicated, minimally privileged account. Restrict access to unrelated credentials and files. 9. Keep WhatsApp authentication state isolated with restrictive filesystem permissions and avoid exposing it to unrelated Python dependencies. 10. Where practical, build and deploy from a verified immutable artifact rather than resolving dependencies during production startup. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose does not align with the detected behavior set, including undeclared historical/financial data retrieval and local dataset loading while apparently lacking the stated alert delivery path. Description-behavior mismatches are dangerous because they can hide unexpected capabilities from users and reviewers, increasing the chance of unapproved data access or covert functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The manifest declares install steps and documents shell/env-driven behavior, but it does not explicitly scope or declare the tools/permissions the skill needs. That weakens reviewability and policy enforcement, making it easier for a skill to execute shell commands or use environment-controlled behavior without clear operator approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is designed to send WhatsApp messages on the user's behalf, but the documentation does not provide a prominent warning or explicit consent boundary before transmission. In messaging contexts, insufficient user notice can lead to accidental disclosure, spam-like behavior, or sending sensitive financial information to the wrong recipient or group.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest's Permissions section says the skill 'optionally syncs reports to Feishu/Lark docs' and references Feishu permission handling, implying a second delivery capability beyond WhatsApp. However, the rest of the file describes only WhatsApp delivery via wu, and the listed implementation files contain no Feishu/Lark component, creating a semantic mismatch between claimed scope and actual functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata describes WhatsApp-only stock alert delivery, but this document adds an undisclosed Feishu/Lark publishing path. That expands the data-flow and permissions surface beyond the declared capability, creating a risk of unauthorized persistence or distribution of watchlists and alert content to another platform that operators may not expect or monitor.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions establish bot write access, shared groups, and persistent report workflows in Feishu that are not disclosed in the skill description. Hidden or undocumented write-capable integrations are dangerous because they can be abused to exfiltrate alert content, create untracked records, or bypass the tighter WhatsApp recipient allowlist by copying data into a broader collaboration system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill for generating stock price watchlist alerts delivered to WhatsApp, with live quotes and local CSV fallback. This file also implements historical price retrieval, company financial metrics lookup, and loading full S&P 500/NASDAQ datasets, which are broader analytics/data-access capabilities not implied by a simple alerting skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · stock_alert_workflow.py (reported line 106)May include surrounding context.

python

if shutil.which("wu") is None:
        return "skipped", "wacli `wu` not installed (npm i -g @ibrahimwithi/wu-cli)"
    try:
        result = subprocess.run(
            ["wu", "send", recipient_jid, message],
            capture_output=True, text=True, check=True,
        )

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs a live network call via yfinance to fetch historical stock data, but there is no visible confirmation prompt, logging, or user-facing warning at the point of execution. The docstring notes that network access is required, but that is developer-facing code documentation rather than a clear user disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function retrieves live company financial data through yfinance, which implies an outbound network request. While the docstring says the lookup is live, there is no visible user-facing notice, prompt, or logging indicating that external data will be requested.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency yfinance is specified with a lower bound only, so installations can resolve to different future versions over time. This weakens build reproducibility and can unintentionally introduce a vulnerable or malicious upstream release into the skill's execution environment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

yfinance>=0.2.37
pandas>=2.2.0
pyyaml>=6.0.1

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The pandas dependency is unpinned, which allows arbitrary newer versions to be installed depending on resolver behavior and install time. This creates supply-chain risk and makes it difficult to verify whether known vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

yfinance>=0.2.37
pandas>=2.2.0
pyyaml>=6.0.1

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The manifest does not pin pandas, so it is impossible to determine from this file alone whether deployment will use a version affected by known advisories. While the cited advisory is disputed and may not apply, the lack of version certainty prevents reliable vulnerability assessment and increases package risk in production.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyYAML is declared with only a minimum version, so the environment may install different releases over time, including versions later found to be vulnerable. Because PyYAML has a history of unsafe deserialization issues, leaving it unpinned increases uncertainty and supply-chain exposure.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

yfinance>=0.2.37
pandas>=2.2.0
pyyaml>=6.0.1

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

PyYAML has multiple historical advisories related to unsafe parsing and deserialization, and the unpinned manifest makes it unclear whether a safe version will be installed. In a skill that may process configuration or watchlist data, an affected PyYAML version could increase the risk of code execution or parser abuse if untrusted YAML is ever consumed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.