Trust Assessment
yahoo-finance received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 3 critical, 2 high, 1 medium, and 0 low severity. Key findings include Persistence / self-modification instructions, Arbitrary command execution, Remote code execution: curl/wget pipe to shell.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/ajanraj/yahoo-finance/SKILL.md:43 | |
| CRITICAL | Arbitrary command execution Remote code download piped to interpreter Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/ajanraj/yahoo-finance/SKILL.md:23 | |
| CRITICAL | Remote code execution: curl/wget pipe to shell Detected a pattern that downloads and immediately executes remote code. This is a primary malware delivery vector. Never pipe curl/wget output directly to a shell interpreter. | Static | skills/ajanraj/yahoo-finance/SKILL.md:23 | |
| HIGH | Recommends executing unverified remote scripts for dependency installation The skill's installation instructions recommend installing the 'uv' package manager by piping the output of 'curl' or 'irm' (Invoke-RestMethod) directly into a shell ('sh' or 'iex'). This practice, often referred to as 'curl | sh', is a significant supply chain risk. If the remote script hosted at 'https://astral.sh/uv/install.sh' or 'https://astral.sh/uv/install.ps1' were compromised, or if a man-in-the-middle attack occurred, arbitrary code could be executed on the system installing the dependency. This bypasses package manager integrity checks and allows for unverified code execution. Recommend installing 'uv' via a package manager (e.g., 'pip install uv' or OS-specific package managers like Homebrew) or by downloading and verifying a signed binary. If direct remote script execution is deemed necessary, advise users to inspect the script content before execution (e.g., 'curl -LsSf https://astral.sh/uv/install.sh > install.sh && less install.sh && sh install.sh'). | LLM | SKILL.md:19 | |
| HIGH | Recommends executing unverified remote scripts for dependency installation The skill's installation instructions recommend installing the 'uv' package manager by piping the output of 'curl' or 'irm' (Invoke-RestMethod) directly into a shell ('sh' or 'iex'). This practice, often referred to as 'curl | sh', is a significant supply chain risk. If the remote script hosted at 'https://astral.sh/uv/install.sh' or 'https://astral.sh/uv/install.ps1' were compromised, or if a man-in-the-middle attack occurred, arbitrary code could be executed on the system installing the dependency. This bypasses package manager integrity checks and allows for unverified code execution. Recommend installing 'uv' via a package manager (e.g., 'pip install uv' or OS-specific package managers like Homebrew) or by downloading and verifying a signed binary. If direct remote script execution is deemed necessary, advise users to inspect the script content before execution (e.g., 'curl -LsSf https://astral.sh/uv/install.sh > install.sh && less install.sh && sh install.sh'). | LLM | SKILL.md:24 | |
| MEDIUM | Persistence mechanism: Shell RC file modification Detected Shell RC file modification pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration. | Static | skills/ajanraj/yahoo-finance/SKILL.md:43 |
Scan History
Embed Code
[](https://skillshield.io/report/0f30abede3f4b36a)
Powered by SkillShield