Agent Economy ReportAgent Economy ReportCAUTION version 1.2.12 · audited 2026-09-09
Stock Market Pro is a market-research toolkit: it pulls quotes, fundamentals and price history from Yahoo Finance via the yfinance library, draws terminal ASCII charts and PNG charts with technical indicators into /tmp, searches DuckDuckGo for news links, and prints Unusual Whales URLs. It also includes an optional headless-browser (Playwright) scraper that loads Unusual Whales option pages and extracts put/call and flow numbers. The code does what the description says: no credentials, tokens, environment variables, wallets or payment logic are touched, nothing is uploaded anywhere, and there is no obfuscated or hidden code. Things a careful user should note: dependencies (yfinance, playwright, matplotlib, ddgs, etc.) are installed at run time by `uv run --script` or pip, the browser is launched with the security sandbox disabled and a spoofed desktop user-agent to get around scraping blocks, and one helper launches another script using a path relative to the current directory. Text fetched from search results and scraped pages is printed back to the agent, which is a normal-but-real channel for untrusted web content to enter the agent's context.
Instructions try to steer the agent beyond the declared purpose. The skill pipes untrusted third-party web text straight into the agent's output stream: search titles/snippets are printed as Markdown in scripts/ddg_search.py line 117 (`sys.stdout.write(f"{i}. [{title}]({href})\n")`) and scraped page text is read with inner_text in scripts/uw.py line 87. Nothing in the package itself contains instructions aimed at overriding the agent, but an attacker-controlled news snippet or web page could reach the agent as if it were skill output.
| Declared purpose | A local-first stock analysis skill: quotes, fundamentals, ASCII trends, high-resolution PNG charts with RSI/MACD/BB/VWAP/ATR, plus optional DuckDuckGo news search and browser-first Unusual Whales options/flow helpers. |
| Observed behavior | Reads market data through yfinance (network), computes indicators with pandas, writes chart PNGs to /tmp, shells out to python3 to run its own bundled scripts, calls the ddgs library for DuckDuckGo news/text search, prints static Unusual Whales URLs, and optionally drives a headless Chromium browser to scrape unusualwhales.com overview and live-options-flow pages. No credential reads, no environment variable access, no persistence, no outbound posting of local data. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Fetches Yahoo Finance data via yfinance (scripts/yf.py line 14), DuckDuckGo search via ddgs (scripts/ddg_search.py line 24) and loads unusualwhales.com pages (scripts/uw.py line 52). All destinations are the disclosed market/search/options services. |
| filesystem_write | needed | Saves chart images to /tmp/<symbol>_pro.png and /tmp/<symbol>_simple.png (scripts/yf.py lines 143 and 393). Filename is built from the user-supplied ticker without sanitizing. |
| shell | needed | Uses subprocess to run its own bundled scripts: scripts/news.py line 46 calls scripts/ddg_search.py, scripts/yf.py lines 324 and 353 call python3 on scripts/uw.py. No user text is passed to a shell interpreter. |
| browser | needed | Launches headless Chromium via Playwright to scrape Unusual Whales (scripts/uw.py lines 56-69), with the browser sandbox disabled and a spoofed Windows Chrome user-agent. |
| install_packages | needed | Dependencies are resolved at run time: inline uv script metadata in scripts/yf.py lines 3-11 and scripts/uw.py lines 3-8, plus documented `pip3 install -U ddgs` in SKILL.md line 89. |
| filesystem_read | needed | Only reads its own script directory path to locate uw.py (scripts/yf.py line 322). No reading of user files, config or key material. |
| severity | finding |
|---|---|
| medium | Headless browser launched with sandbox disabled Running Chromium with --no-sandbox removes an OS-level isolation layer while loading remote, attacker-influenceable web pages. A browser exploit would then run with the agent's own privileges. Common in containers, but it is a real reduction in defence in depth. scripts/uw.py:59 args=["--disable-gpu", "--no-sandbox"], |
| low | User-agent spoofing to scrape a site that blocks scraping The skill acknowledges in SKILL.md line 100 that 'Unusual Whales frequently blocks scraping/headless access' and then presents itself as a normal desktop browser. This is anti-bot evasion and may violate the site's terms of service; it is not a security compromise of the user's machine. scripts/uw.py:65 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" |
| low | Sub-script executed via a path relative to the current directory news.py runs `python <cwd>/scripts/ddg_search.py`. If the agent invokes it from a directory where an unrelated or attacker-writable scripts/ddg_search.py exists, that file would be executed instead of the vendored helper. Using an absolute path derived from __file__ would avoid this. scripts/news.py:33 "scripts/ddg_search.py", |
| low | Output filename built from unsanitized ticker argument The ticker string is inserted directly into a /tmp path. A ticker containing path separators (e.g. '../..') would cause the PNG to be written outside /tmp, overwriting an arbitrary file the agent can write. Impact is limited to whatever the caller passes as a symbol. scripts/yf.py:143 path = f"/tmp/{symbol}_pro.png" |
| low | Dependencies fetched and installed at run time Running the scripts triggers installation of yfinance, playwright, matplotlib, mplfinance, rich, pandas, plotille (scripts/yf.py lines 3-11) and, for the news add-on, the ddgs package (SKILL.md line 89). Code from PyPI is executed on the host; version pinning is absent, so the exact code installed can change over time. SKILL.md:29 > This skill uses `uv run --script` for dependency handling. |
| info | Optional proxy/Tor routing flag Search traffic can be routed through an arbitrary user-specified proxy. The default is None (direct connection) and no proxy is hard-coded, so this is a user-controlled option rather than hidden traffic redirection. scripts/ddg_search.py:72 help='Proxy URL (http/https/socks5). For Tor Browser: "tb" (socks5://127.0.0.1:9150) if supported by ddgs.', |
| info | TLS verification can be turned off Certificate checking defaults to on, but the flag allows disabling it, which would expose search traffic to interception if a user passes --verify false. scripts/ddg_search.py:75 p.add_argument("--verify", default="true", choices=["true", "false"], help="TLS verify") |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| github.com | not in the service index | SKILL.md:30 |
| unusualwhales.com | not in the service index | SKILL.md:109 |
| Binaries invoked | bash, pip, pip3, python, python3, uv |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 7 |
| base64 blobs | 0 |
| File writes | 2 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 134 | b48066924239fb1e… |
_meta.json | 6 | 663cdd0d2b4edfaf… |
scripts/ddg_search.py | 124 | 5685f2ee5b5c1353… |
scripts/news.py | 50 | 0f306b5f09f56da1… |
scripts/options_links.py | 34 | 700b202774ceba93… |
scripts/uw.py | 271 | c24c9354c72d3361… |
scripts/yf.py | 401 | dc6b783d729ad636… |
skill-card.md | 43 | d72918686719af53… |
For agents
JSON: https://agenteconomy.report/k/stock-market-pro.audit.json · badge: https://agenteconomy.report/k/stock-market-pro.audited.svg ·
skill rating: /k/stock-market-pro · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).