finviz-screener
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The script
scripts/open_finviz_screener.pyimplements strict validation for user-supplied filter codes and sort orders using restrictive regular expressions (^[a-z0-9_.-]+$). This effectively prevents URL injection and shell command injection attacks. - [SAFE]: Subprocess calls used to open the web browser are executed using argument lists rather than shell strings, and the
shell=Trueparameter is not used, which minimizes the risk of command execution vulnerabilities. - [SAFE]: The skill manages the
FINVIZ_API_KEYenvironment variable securely by only checking for its existence to enable "Elite" mode features; the key is never displayed, logged, or transmitted externally. - [SAFE]: There are no external package dependencies or remote code execution patterns; the skill operates entirely using the Python standard library.
Audit Metadata