alphaear-signal-tracker

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This finance signal tracker is not clearly malicious, but it needs review because it ships broader web, LLM, model-download, training, and database-mutation capabilities than the main description discloses.

Install only if you are comfortable with a finance-analysis skill that may contact multiple external search/news/model/LLM services and store or modify market, news, search, and signal data locally. Avoid using it with proprietary watchlists or sensitive research unless network access, API keys, model downloads, and SQLite database access are reviewed and restricted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares a narrow finance-tracking purpose, but the metadata and referenced implementation imply access to environment variables, filesystem, network, and shell-like capabilities without any explicit permission boundary. This creates a broad, implicit trust surface where an agent invoking the skill could perform actions far beyond signal tracking, increasing the risk of data exfiltration, arbitrary file modification, or command execution through transitive code paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared behavior is limited to tracking investment signal evolution, but the referenced behavior spans broad research, report generation, caching, database storage, model routing, and even training/evaluation workflows. This mismatch is dangerous because reviewers and orchestrators may grant or invoke the skill under false assumptions, allowing hidden high-risk behaviors to execute with more authority than intended.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: fetch_news_content accepts an arbitrary user-supplied URL and performs remote retrieval with no visible validation, allowlist, or restriction to expected news domains. In an agent setting, this can enable SSRF-style access to internal services or unintended requests to attacker-controlled endpoints, and the finance-signal context does not justify fully arbitrary URL fetching.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The `execute_query` method exposes raw SQL execution to any caller, including non-SELECT statements that are committed automatically. In a finance signal tracking skill, this creates an unnecessary and dangerous capability that can be abused for unauthorized data reads, deletion, tampering of cached news/signals, and schema manipulation if untrusted input reaches this method.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring suggests a custom query helper, but the implementation silently permits and commits database-modifying SQL. This mismatch increases the risk that other components or maintainers will treat it as a safe read helper while it actually enables destructive writes, making accidental misuse or abuse much more likely.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as tracking finance investment signals, but this code aggregates broad social, general-interest, and tech trending sources such as Weibo, Zhihu, Douyin, and Hacker News. That scope expansion increases the chance of collecting unrelated or manipulable inputs, which can poison downstream finance-signal analysis, create unnecessary data exposure, and violate least-privilege expectations for the skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The Polymarket integration extends the skill from finance/news monitoring into prediction-market sentiment collection, which is not stated in the manifest. This creates capability drift: the agent can ingest speculative external signals that may bias decisions, trigger compliance concerns, or expose users to behavior they did not authorize when enabling a finance news tracker.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This code materially exceeds the stated scope of a signal-tracking skill by building, training, evaluating, and persisting a new predictive model. That expansion increases attack surface through uncontrolled compute use, stateful artifact creation, and behavioral drift, especially if the skill is expected to be read-only or analysis-only in production.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill performs live web/news searches and sends retrieved content to an LLM for causality verification, which goes beyond the described purpose and introduces undisclosed external data flows. In a finance context, this can leak watchlists, analysis targets, and gathered content to third parties and makes outputs dependent on untrusted remote sources.

Context-Inappropriate Capability

Low

• Confidence: 72% confidence
• Finding: The module auto-selects an external LLM provider based on environment state and later sends analyzed text to that provider. In a finance-oriented skill, this creates an implicit data egress path and can route potentially sensitive market/news content to third-party services without explicit user consent or strict configuration control.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This function performs outbound network requests based on user input but the interface text does not clearly warn that using it will transmit data to external systems. In agent workflows, lack of disclosure increases the chance of unintentionally sending sensitive URLs, tokens embedded in URLs, or internal hostnames to third parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: enrich_news_content fetches remote content and writes it into persistent storage without making the state-changing behavior prominent at the interface level. In an agent environment this can cause unintended database modification, persistence of attacker-controlled content, and contamination of downstream analytics or retrieval pipelines.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: batch_update_sentiment persistently modifies sentiment fields in the database, but the interface does not strongly communicate that it is a write operation. This can lead to accidental data mutation by an agent or operator, especially where tools are selected automatically from natural-language descriptions.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code fetches tokenizer and model artifacts directly from remote repositories at runtime via from_pretrained() without pinning exact revisions, verifying checksums, or disclosing that network retrieval will occur. This creates a supply-chain risk: a compromised upstream model, changed artifact version, or malicious repository content could alter predictions or potentially trigger unsafe deserialization behavior in downstream libraries.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Search queries composed from stock names, tickers, and dates are sent to an external search engine without transparency or consent. In a finance workflow, those queries can reveal proprietary interest, strategies, or monitored assets, creating confidentiality and operational-intelligence leakage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code forwards search-result content and stock-event context to an external LLM without a clear warning, creating an additional third-party data exposure path. Because the content is dynamically gathered and may include sensitive research context, this is more dangerous in a finance-analysis skill than in a generic consumer app.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The search function transmits user queries to external search providers such as Jina, DuckDuckGo, and Baidu without any in-code consent flow, disclosure, or data-classification guardrails. In a finance signal-tracking skill, queries may contain proprietary research topics, positions, watchlists, or other sensitive investment intelligence, so silent third-party transmission creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The enrichment path sends fetched result URLs to an external extraction service via Jina Reader, again without clear disclosure or controls. Even when only URLs are sent, they can reveal sensitive research targets, internal watchlists, unannounced counterparties, or private resources if upstream results include internal or authenticated links, making this especially concerning in a finance-monitoring context.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: When the model is not cached locally, the code downloads a transformer model from the network automatically. This introduces supply-chain and integrity risk, especially in unattended or production environments, because model artifacts are fetched at runtime without explicit approval, pinning, or verification.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

2.  **Analyze**: Use **FinAnalyst Prompt** to generate the initial `InvestmentSignal`.
3.  **Track**: For existing signals, use **Signal Tracking Prompt** to assess evolution (Strengthened/Weakened/Falsified) based on new info.

**Tools:**
- Use `alphaear-search` and `alphaear-stock` skills to gather the necessary data.
- Use `scripts/fin_agent.py` helper `_sanitize_signal_output` if needing to clean JSON.

• Confidence: 87% confidence
• Finding: Tools:*

VirusTotal

56/56 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/utils/predictor/evaluation.py:59

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/utils/predictor/training.py:308