Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/index.js:4430
- Evidence
const { stdout } = await exec(bin, argv, { maxBuffer: 32 * 1024 * 1024 });
Security audit
Stock Analysis
Security checks across malware telemetry and agentic risk
Overview
The stock-analysis plugin is mostly coherent, but it needs review because some helper scripts can turn user-supplied stock symbols or names into shell commands.
Review before installing. The plugin appears designed for stock analysis and not for data theft or destructive behavior, but only install it in an environment where the postinstall Python setup and outbound market/search API calls are acceptable. Avoid passing untrusted stock symbols or company names until the shell=True command construction is fixed or the plugin is sandboxed.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
65/65 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.ts:14
- Evidence
const { stdout } = await exec(bin, argv, { maxBuffer: 32 * 1024 * 1024 });
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/setup-python.mjs:18
- Evidence
execSync(cmd, { stdio: "pipe", timeout: 300_000 });