yahooquery
Fail
Audited by Snyk on Feb 14, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes examples and config options that pass Yahoo username/password directly as string arguments (e.g., Research(username='...', password='...')), which encourages embedding plaintext credentials in generated code or commands and therefore creates an exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill programmatically fetches public Yahoo Finance content (e.g., Ticker.news(), Screener.get_screeners(), yq.search(), get_trending(), and Research.reports()), ingesting open third‑party web content including news and message‑board/user‑generated data that the agent is expected to read and interpret.
Audit Metadata