yahoo-finance
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs network requests to legitimate Yahoo Finance domains (e.g., query1.finance.yahoo.com and fc.yahoo.com) to retrieve stock prices and other financial metrics. This behavior is consistent with the skill's stated purpose and targets well-known service endpoints.
- [EXTERNAL_DOWNLOADS]: The scripts fetch financial datasets in JSON and CSV formats. No executable code, remote scripts, or binary payloads are downloaded or executed during operation.
- [COMMAND_EXECUTION]: The command-line utilities use the standard argparse library to handle user-supplied inputs such as ticker symbols and date ranges. This data is used exclusively to parameterize API requests and is not passed to dangerous shell execution functions.
- [SAFE]: The skill implements standard session management to handle Yahoo's 'cookie + crumb' authentication mechanism. No sensitive user credentials or hardcoded API keys were detected in the source code.
- [SAFE]: Indirect Prompt Injection Surface: The skill ingests untrusted text data (news headlines and company summaries) from Yahoo Finance APIs. Ingestion points: fetch_all.py and fetch_quote.py. Boundary markers: Absent. Capability inventory: File system write access for outputting data. Sanitization: Absent. The risk is considered low and characteristic of data aggregation tools.
Audit Metadata