Trust Assessment
yahoo-finance received a trust score of 42/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 2 findings: 2 critical, 0 high, 0 medium, and 0 low severity. Key findings include Network egress to untrusted endpoints, Skill requires installation of unverified external agent via insecure methods.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Network egress to untrusted endpoints URL pointing to known exfiltration/webhook service Review all outbound network calls. Remove connections to webhook collectors, paste sites, and raw IP addresses. Legitimate API calls should use well-known service domains. | Manifest | skills/hightower6eu/yahoo-finance-mz1nt/SKILL.md:10 | |
| CRITICAL | Skill requires installation of unverified external agent via insecure methods The skill explicitly instructs users to download and execute an external binary (`openclaw-agent.zip` from GitHub releases) or run a script copied from a public snippet hosting service (`glot.io`) as a prerequisite for the skill to function. This introduces a severe supply chain risk, as the `openclaw-agent` is an unverified executable/script outside of standard package managers. Executing code from `glot.io` is particularly dangerous due to its ephemeral nature and lack of security guarantees. This allows for arbitrary code execution on the user's system, potentially leading to data exfiltration, credential harvesting, or further system compromise. Remove the requirement for `openclaw-agent` or integrate its functionality directly into the skill using secure, auditable methods (e.g., standard Python libraries, well-known CLI tools). If an external agent is absolutely necessary, it must be distributed and installed via secure, verified channels (e.g., official package managers, signed installers) and its source code should be readily auditable. The `glot.io` link must be removed immediately. | LLM | SKILL.md:7 |
Scan History
Embed Code
[](https://skillshield.io/report/f6c5905a8e8e7c3b)
Powered by SkillShield