xvary-stock-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow fetches external market quote data from Yahoo Finance, Finviz, and Stooq, which exposes the agent to outsider-authored web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill contains operational Python tool scripts that perform runtime HTTP requests to third-party endpoints (sec.gov, finance.yahoo.com, finviz.com, stooq.com) to fetch financial and market data without pin/digest integrity checks, constituting common/reputable unofficial dependencies.