Top Performer Scanner

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed stock-research utility that downloads public market data and writes local CSV output, with some documentation and dependency hygiene issues but no evidence of hidden control, credential access, persistence, or exfiltration.

Install and run this only in a normal non-privileged Python environment, preferably a virtualenv. Treat the results as research, not trading advice; verify important findings with another data source because the symbol list uses FTP and Yahoo Finance data can have gaps. Consider pinning dependency versions before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: get_true_top_500.py:64

Finding

NASDAQ Symbol Data Retrieved over Unauthenticated FTP

Content

View full analysis

Vulnerability Details

File Location: get_true_top_500.py, line 64
Vulnerability Type: Unauthenticated and unencrypted network transport
Risk Level: Medium

Vulnerable Code

python

def download_nasdaq_symbols():
    """Download all US-traded symbols from the NASDAQ FTP directory."""
    print("1. Downloading all US traded symbols from NASDAQ FTP...")
    url = "ftp://ftp.nasdaqtrader.com/symboldirectory/nasdaqtraded.txt"
    try:
        response = urllib.request.urlopen(url)
        data = response.read().decode("utf-8")
        df_sym = pd.read_csv(io.StringIO(data), sep="|")
    except Exception as e:
        print(f"Failed to download or parse NASDAQ directory: {e}")
        exit(1)

Technical Analysis

The application retrieves the symbol universe through plaintext FTP. FTP does not provide transport encryption or authenticated server identity. An attacker capable of intercepting or modifying traffic—such as a malicious network operator, compromised gateway, or hostile local-network participant—could replace the symbol-directory response.

The downloaded content is parsed directly as a pipe-delimited data frame without cryptographic integrity verification. Basic filtering does not establish that the records originated from NASDAQ. Because these symbols define the input universe for subsequent Yahoo Finance queries, modified data can silently influence the generated rankings and CSV output.

This path does not directly evaluate the response as executable code, so no arbitrary code execution or privilege escalation was identified.

Attack Path

1. A user runs get_true_top_500.py on a network observed or controlled by an attacker.
2. The script requests nasdaqtraded.txt through plaintext FTP.
3. The attacker intercepts the FTP response and substitutes a syntactically valid, maliciously modified symbol directory.
4. The script parses the substituted records and applies on ...[truncated 786 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the FTP endpoint with an official HTTPS endpoint that provides authenticated TLS.
2. Require certificate validation and fail closed on TLS or hostname verification errors.
3. If NASDAQ publishes checksums or signed artifacts, verify them before parsing the response.
4. Validate the downloaded schema, required columns, expected footer, record count bounds, symbol syntax, and allowed field values.
5. Apply response-size and network-timeout limits to reduce resource-exhaustion risks.
6. Record the source URL, retrieval timestamp, and integrity digest with generated results for reproducibility.
7. For high-integrity financial research, cross-check the symbol universe against an independent authenticated source.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Third-Party Dependencies Are Not Reproducibly Pinned or Integrity-Verified

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2; SKILL.md, line 93
Vulnerability Type: Unbounded dependency resolution and missing package integrity controls
Risk Level: Medium

Vulnerable Code

requirements.txt:

text

pandas>=1.5.0
yfinance>=0.2.30

Installation instruction in SKILL.md:

bash

pip3 install pandas yfinance

Technical Analysis

Both dependencies use open-ended minimum-version constraints, while the documented installation command specifies no versions at all. A future installation can therefore resolve package releases that were not present or reviewed when this project was audited.

No lock file or package hashes are supplied. Consequently, installations are not reproducible and do not cryptographically constrain downloaded distributions to known artifacts. If a permitted future dependency release or one of its transitive dependencies is compromised, the affected package can execute code during installation or when imported by these scripts.

The package names themselves appear legitimate, and the reviewed project contains no evidence that they were intentionally selected for dependency confusion or typosquatting. The risk arises from unconstrained future resolution and absent integrity verification rather than a confirmed malicious package.

Attack Path

1. An attacker compromises a permitted future release of pandas, yfinance, or a transitive dependency, or compromises the relevant package-publishing account.
2. A user follows SKILL.md and runs pip3 install pandas yfinance, or installs from requirements.txt.
3. The package resolver selects the compromised release because no exact upper or exact version constraint prevents it.
4. No hash check detects that the selected artifact differs from a previously reviewed build.
5. Malicious package code executes during installation or when pandas or yfinance is imported.
6. The ...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin direct and transitive dependencies to versions reviewed and tested by the project.
2. Generate a lock file using a controlled dependency-resolution process.
3. Record SHA-256 hashes for every approved distribution and install with pip --require-hashes.
4. Update SKILL.md to direct users to the locked, hash-verified dependency file rather than an unconstrained pip3 install command.
5. Download packages only from an explicitly configured trusted HTTPS package index.
6. Run vulnerability and provenance checks as part of dependency updates.
7. Review and regenerate pins on a scheduled basis so security fixes can be adopted without allowing arbitrary future releases.
8. Install and execute the project in an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description claims comprehensive, bias-resistant market analysis, while the detected behavior indicates it instead performs feasibility testing on predefined tickers and does not implement the advertised data collection and ranking logic. This mismatch is security-relevant because users or downstream agents may trust outputs as if they were independently computed from a full universe, leading to false conclusions, unsafe automation decisions, or concealment of what the code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires internet access and instructs users to run scripts that fetch data from NASDAQ and Yahoo Finance, but it declares no tool scope or permissions. In an agent environment, undeclared network capability is dangerous because it bypasses least-privilege expectations, makes outbound data flows less auditable, and can enable unexpected remote interaction if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes downloading all NASDAQ-listed symbols, filtering to the top 500 by daily dollar volume, and ranking annual returns without survivorship bias. This file instead accepts a small user-supplied ticker list, downloads only those symbols, and evaluates heuristic trigger frequencies for 'strict/strong/broad' filters rather than performing yearly market-wide top-performer ranking.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The docstring and argument-parser description imply validation against a defined set of true historical top performers. In practice, the script simply analyzes whatever tickers are passed, with a default shortlist of APP, PLTR, NVDA, and CVNA, so the documentation overstates the semantic grounding of the analysis.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a lower bound only, which allows future major or minor releases of pandas to be installed without review. This creates supply-chain and stability risk because a newly released version could introduce breaking changes or a vulnerable transitive dependency into the environment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas>=1.5.0
yfinance>=0.2.30

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The yfinance dependency is also unpinned, so builds are not reproducible and may silently consume a newly published release. If an upstream release is compromised or introduces unsafe behavior, the skill could begin running different code than what was originally tested.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas>=1.5.0
yfinance>=0.2.30

Static analysis

No suspicious patterns detected.