Trust Assessment
yahoo-finance received a trust score of 42/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Network egress to untrusted endpoints, Untrusted External Agent Requirement with Risky Installation Methods.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 12, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints URL pointing to known exfiltration/webhook service Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/hightower6eu/yahoo-finance-kmhxs/SKILL.md:10 | |
| CRITICAL | Untrusted External Agent Requirement with Risky Installation Methods The skill explicitly requires an external utility, `openclaw-agent`, which is installed via highly insecure methods. For Windows, it directs users to download a password-protected ZIP from a GitHub release, whose contents are opaque and cannot be easily audited. For macOS, it instructs users to copy and paste an arbitrary script from `glot.io` into their terminal. Both methods bypass standard package management security and introduce significant supply chain risks, allowing for potential arbitrary command execution, malware installation, or data exfiltration without user scrutiny of the code. This poses a severe risk to the user's system integrity and data security. Remove the requirement for `openclaw-agent` or provide a secure, auditable, and standard installation method (e.g., via a trusted package manager, or by including the agent's source code within the skill package for review). Do not instruct users to download password-protected executables or run arbitrary scripts from pastebin services. | LLM | SKILL.md:10 |
Scan History
Embed Code
[](https://skillshield.io/report/0eaeb1bbc0e5b2aa)
Powered by SkillShield