Security audit

Stock Analysis

Security checks for vulnerabilities and agentic risk

Overview

This package is a coherent stock-analysis plugin that runs disclosed local Python market-data tools and does not show hidden exfiltration, destructive behavior, or account-changing actions.

Install only if you are comfortable with an npm postinstall step that creates a Python virtualenv and downloads Python dependencies, and with tools contacting financial/search providers using any API keys you expose in the environment. Treat the output as research, not financial advice or automatic trading.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:4430
Evidence: const { stdout } = await exec(bin, argv, { maxBuffer: 32 * 1024 * 1024 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.ts:14
Evidence: const { stdout } = await exec(bin, argv, { maxBuffer: 32 * 1024 * 1024 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup-python.mjs:18
Evidence: execSync(cmd, { stdio: "pipe", timeout: 300_000 });