yfinance-client

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:45 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Yahoo Finance data client with ordinary dependency and market-data network risks, but no hidden persistence, credential handling, or destructive behavior found.

Install this only in an environment where you are comfortable adding yfinance and pandas, preferably with pinned versions from a trusted package source. Treat returned market data as third-party Yahoo Finance data that may be delayed or incomplete, and do not rely on it alone for financial decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:29

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 29-32
Vulnerability Type: Supply-chain risk from mutable dependency resolution
Risk Level: Medium

Complete Code Snippet:

markdown

### Installation

```bash
pip install yfinance pandas

text

### Technical Analysis

The installation command does not pin package versions, verify package hashes, use a lockfile, or specify a trusted package index. Consequently, `pip` resolves the latest compatible releases of `yfinance`, `pandas`, and their transitive dependencies from the user's configured index at installation time.

This does not prove that either named package is malicious. However, it makes the installed code mutable after the Skill has been reviewed. A compromised upstream release, malicious transitive dependency, dependency-confusion condition, or attacker-controlled pip index could introduce arbitrary package installation or runtime code.

### Attack Path

1. An attacker compromises an upstream package or transitive dependency, or influences the package index configured in the victim's environment.
2. The victim follows the documented `pip install yfinance pandas` command.
3. `pip` resolves mutable, unverified package versions from the configured index.
4. The malicious package is downloaded and installed.
5. Attacker-controlled build, installation, import-time, or runtime code executes under the account running the command.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user performing the installation or subsequently importing the dependency. The accessible scope may include that user's files, environment variables, application data, network access, and credentials available to the process. The Skill itself does not request elevated privileges, so privilege escalation beyond the installing user's permissions is not established by the reviewed evidence.

Remediation

View remediation

Remediation Suggestions

• Pin all direct and transitive dependencies to reviewed versions in a requirements lockfile.
• Generate and record cryptographic hashes for every approved distribution.
• Install with hash enforcement, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Configure an explicit trusted package index or an internally controlled dependency mirror.
• Review and update dependencies through a controlled process that includes vulnerability scanning and provenance verification.
• Prefer prebuilt, verified wheels and prohibit unexpected source builds in production installation workflows.
• Add automated checks that reject unpinned dependencies and lockfile changes lacking security review.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · client.py (reported line 521)May include surrounding context.

python

"""
        tickers = yf.Tickers(" ".join(symbols))
        return {
            symbol: getattr(tickers, symbol).info.get("currentPrice")
            for symbol in symbols
        }

Static analysis

No suspicious patterns detected.