Stock Fundamentals

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:06 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward stock-fundamentals lookup tool, with disclosed Yahoo Finance/yfinance data access and no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you are comfortable with the skill contacting Yahoo Finance/yfinance for each ticker lookup and with uv resolving an unpinned yfinance package at runtime. For stronger security, pin yfinance to a reviewed version or use a lockfile and run the skill in a least-privileged environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: src/main.py:5

Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: src/main.py:5-9 and SKILL.md:26-32
Vulnerability Type: Unpinned and mutable third-party dependency
Risk Level: Medium

The executable declares yfinance without an exact version, while the documented invocation instructs uv run to resolve and install the dependency automatically.

python

# /// script
# requires-python = ">=3.12"
# dependencies = [
#   "yfinance",
# ]
# ///

The corresponding execution instructions are:

markdown

```bash
uv run /root/.openclaw/workspace/skills/stock-fundamentals/src/main.py <TICKER>

> uv run reads the inline dependency block at the top of main.py and auto-installs yfinance in an isolated environment. No pip install or venv setup needed.

text

### Technical Analysis

The dependency declaration does not constrain `yfinance` to a specific, reviewed release, and the project contains no lockfile or package-integrity hashes. Consequently, the code executed by the Skill can change between invocations even when the project itself remains unchanged.

Python packages can run code during installation and when imported. Because `src/service.py` imports `yfinance` at module initialization, any malicious or compromised version selected by the package resolver could execute code under the identity and permissions of the process running the Skill. An isolated dependency environment limits package conflicts but does not prevent package code from accessing resources available to the invoking user.

This is a supply-chain exposure rather than evidence that the current `yfinance` package is malicious. The risk arises from automatically trusting future mutable releases without version or integrity controls.

### Attack Path

1. An attacker compromises the upstream `yfinance` project, a maintainer account, or its package-distribution channel and publishes a malicious release.
2. A user or Agent invokes the documen
...[truncated 1003 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yfinance to an exact reviewed version in the inline dependency declaration, for example:

   python

   # dependencies = [
   #   "yfinance==REVIEWED_VERSION",
   # ]
   

2. Generate and commit a lockfile that records the complete transitive dependency graph.

3. Enforce locked or frozen resolution during execution so an invocation fails rather than silently selecting newer packages.

4. Verify package artifacts with cryptographic hashes where the package-management workflow supports them.

5. Review dependency updates before changing the pinned version, including transitive dependency and provenance changes.

6. Run the Skill under a least-privileged account or sandbox with restricted filesystem access, sanitized environment variables, and network access limited to required financial-data endpoints.

7. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This function fetches remote data through the yfinance client and accesses multiple remote-backed properties, which can transmit the requested symbol and request metadata over the network. While the function has docstrings, they describe purpose rather than clearly warning users that an external network call will occur.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.