tradingview-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a personal GitHub repository (an unverified/individual upstream) used as the pinned source for a downloadable server—pulling and running binaries or code from an unknown GitHub user is a potential malware distribution risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow exposes TradingView scanner/Yahoo Finance data via the bundled tradingview MCP server (tools like stock_prices, coin_analysis, and exchange-wide scanners), where any outsider-supplied inputs (e.g., tickers/symbols and scan parameters) are used to retrieve and read external third-party content at request time.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill states "the first call downloads the pinned server and dependencies" and references the upstream GitHub repository https://github.com/atilaahmettaner/tradingview-mcp, indicating runtime fetching and execution of remote code that provides the MCP tools the agent relies on.