Dividend Growth Pullback Screener

• Outcome: Pass
• Latest audit: May 27, 2026 at 9:48 PM UTC
• Version:
  0.1.0

Overview

This is a disclosed stock-screening skill whose main risks are normal API-key handling and treating generated investment ideas as advice.

Install only if you are comfortable running a local Python screener that sends your FMP and optional FINVIZ API keys to those providers and writes reports locally. Prefer environment variables or a secret manager over command-line key flags, avoid storing keys permanently in shell profiles on shared machines, and verify any stock ideas independently before trading.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to use environment variables, execute Python scripts, make external API calls, and write output files, yet it declares no permissions. That mismatch is a real security issue because it can cause capability creep or invisible privilege assumptions, making it harder for a caller or platform to understand and constrain what the skill will do.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This content provides concrete, prescriptive investment guidance on screening criteria, entry timing, holding periods, monitoring, trimming, and exit triggers in a way that a user could reasonably treat as actionable financial advice. Although a disclaimer appears at the end, it is not prominent or early enough to mitigate the risk that users will act on the recommendations without understanding that the guidance is generalized and may be unsuitable for their financial situation, risk tolerance, tax status, or time horizon.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation recommends passing an API key directly on the command line, which can expose the secret through shell history, process listings, logging, or job-control tools on multi-user systems. While this is common in examples, it is still an unsafe secret-handling practice because users may copy it verbatim into real environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The FINVIZ example also places the API key in a command-line argument, creating the same credential-exposure risk via shell history, process tables, CI logs, or terminal recording tools. In the context of an agent skill guide, this is likely to be copied by users as-is, increasing the chance of accidental secret disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document gives concrete trading instructions, position sizing, stop-loss guidance, and exit criteria without a clear disclaimer that the content is educational only, may cause financial loss, and is not personalized investment advice. In a stock-screening/investing skill, users may reasonably treat this as actionable guidance, increasing the risk of harmful reliance on unsuitable financial decisions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Allowing API keys to be passed on the command line can expose secrets to local process listings, shell history, job control logs, or monitoring tools on multi-user systems. While this does not automatically exfiltrate credentials, it increases the chance that other local users or forensic artifacts can recover them.

VirusTotal

62/62 vendors flagged this skill as clean.