deep-analysis
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Automated security scans identified a phishing URL (https://www.99qh.com/) within the data source registry file (scripts/lib/data_source_registry.py), which is also flagged as malware by file reputation scanners.\n- [REMOTE_CODE_EXECUTION]: The run.py script contains logic to download and execute the cloudflared binary directly from GitHub. It also dynamically manages Python dependencies by executing pip install from various third-party mirrors at runtime.\n- [PRIVILEGE_ESCALATION]: The skill uses sudo commands in run.py to move downloaded binaries into system-protected directories such as /usr/local/bin during its environment setup phase.\n- [DATA_EXFILTRATION]: The skill provides a remote mode that starts a local HTTP server and creates a public Cloudflare Tunnel to expose generated analysis reports to the internet, potentially leaking stock analysis data and local files to unauthenticated users.\n- [COMMAND_EXECUTION]: Extensive use of the subprocess module in run.py allows for the execution of arbitrary system commands for dependency management and network tunneling, which is susceptible to injection if inputs are not strictly validated.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata