Security audit

sec-guidance

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently fetches public SEC filings and optionally uses an LLM to summarize cited passages, with no evidence of hidden or destructive behavior.

Before installing, be aware that normal use contacts SEC EDGAR, may send selected filing passages and your query to Anthropic or OpenAI when an API key is configured, and stores downloaded public filing text in ~/.cache/sec-guidance. Pin dependencies or use a lockfile if reproducible installs matter.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents capabilities to access environment variables, read and write local files, and perform network requests, yet it declares no permissions. This creates a transparency and consent problem: users and orchestration layers cannot accurately assess or constrain what the skill will do, especially since it fetches remote SEC data, uses API keys, and writes a persistent cache under the user's home directory.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The documentation says the skill is self-contained by default, but it also states that filings are cached persistently under ~/.cache/sec-guidance. That discrepancy can mislead users into assuming no local state is created, which matters in shared or sensitive environments where SEC queries or retrieved documents should not remain on disk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill indicates it will use Claude or OpenAI when API keys are present, but it does not prominently warn that filing text and user queries may be transmitted to third-party LLM providers. Even though SEC filings are public, user questions, derived excerpts, usage patterns, and any embedded proprietary analysis context may still create privacy, compliance, or data-governance concerns.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 beautifulsoup4>=4.11 rank-bm25>=0.2.2 anthropic>=0.34
Confidence: 95% confidence
Finding: The dependency specification uses a lower-bound version constraint (`requests>=2.28`) instead of pinning to an exact version or a tightly controlled range. This makes builds non-reproducible and can introduce unexpected or vulnerable upstream releases during installation, which is a real supply-chain risk even though it is common and usually unintentional.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 beautifulsoup4>=4.11 rank-bm25>=0.2.2 anthropic>=0.34 # openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
Confidence: 94% confidence
Finding: `beautifulsoup4>=4.11` is unpinned, so installations may resolve to different versions over time. This weakens reproducibility and can allow accidental introduction of breaking changes or newly published vulnerable versions from the package ecosystem.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 beautifulsoup4>=4.11 rank-bm25>=0.2.2 anthropic>=0.34 # openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
Confidence: 93% confidence
Finding: `rank-bm25>=0.2.2` is specified with only a minimum version, which leaves dependency resolution open-ended. While not an exploit by itself, this is a legitimate supply-chain hygiene issue because future installs may pull unexpected package contents or insecure versions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28 beautifulsoup4>=4.11 rank-bm25>=0.2.2 anthropic>=0.34 # openai>=1.0 # optional — install if you want to use OpenAI instead of Anthropic
Confidence: 95% confidence
Finding: `anthropic>=0.34` is also unpinned, creating the same reproducibility and supply-chain exposure as the other dependencies. In a skill that interacts with external LLM APIs, dependency drift can also affect request handling, authentication behavior, or security-related defaults unexpectedly.

Static analysis

No suspicious patterns detected.