yahoo-finance
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
uvpackage manager by executing remote scripts fromastral.sh, which is a well-known service provider in the Python ecosystem. - [COMMAND_EXECUTION]: The documentation describes standard setup procedures, including modifying file permissions with
chmodand creating symbolic links for CLI accessibility. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided stock symbols and search strings are ingested through the
yfscript's command-line arguments. - Boundary markers: The instructions do not explicitly specify delimiters or boundary markers for ticker symbols when processed by the agent.
- Capability inventory: The skill retrieves market data from Yahoo Finance via network requests made by the
yfinancelibrary. - Sanitization: Relies on the underlying Python libraries to handle ticker validation and data parsing.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata