Noah Stock Trade

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:39 PM UTC
• Version:
  0.1.4

Overview

This skill is a sensitive but coherent stock-account query helper that uses a user-provided trading API token and does not expose live order placement.

Install only if you trust this skill with stock-account, holdings, order, asset, deal, and capital-flow data. Prefer a read-only or test token if available, confirm the API base URL before use, and do not treat this version as approved for placing, modifying, or canceling trades.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to use local scripts, read reference files, depend on environment variables and bearer tokens, and call external trading APIs, but it declares no explicit permissions. This creates a capability/permission mismatch that can undermine sandboxing, auditability, and informed deployment decisions, especially in a financial context where sensitive account data may be queried over the network.

VirusTotal

67/67 vendors flagged this skill as clean.