Security audit

Stock Watcher THS

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stock-watchlist purpose, but its uninstall script can delete an arbitrary environment-selected directory without validation or confirmation.

Review the uninstall script before installing or running it. Avoid setting STOCK_WATCHER_DATA_DIR to any important directory, and prefer fixing uninstall.sh to delete only a known watchlist file or validated app-owned directory with explicit confirmation. The main watchlist and quote-fetching scripts otherwise appear consistent with the stated purpose.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents and enables filesystem, environment-variable, and network usage, but no explicit permission model is declared for those capabilities. This creates a transparency and least-privilege problem: a caller may invoke a seemingly simple watchlist skill without realizing it can write local files, read environment-controlled paths, and fetch remote content, which increases the risk of unintended data exposure or misuse if the skill is modified or abused.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The uninstall script derives the deletion target from the STOCK_WATCHER_DATA_DIR environment variable and then recursively deletes it with rm -rf. Because there is no validation that the resolved path is confined to the skill's own data directory, a caller can point it at arbitrary filesystem locations, causing unintended data loss well beyond the watchlist scope.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script performs an immediate recursive delete of the target directory without any confirmation, dry-run option, or warning. In combination with path selection from an environment variable, this makes accidental or scripted destructive use much more likely and increases the chance of irreversible local data loss.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0
Confidence: 95% confidence
Finding: requests>=2.31.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0
Confidence: 95% confidence
Finding: beautifulsoup4>=4.12.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.