Scanned skills

tradermonty/claude-trading-skills us-undervalued-growth-screener

Checked the catalogued skill at us-undervalued-growth-screener.

SkillTrust corpus scan 20 September 2026 v0.10.0 via skillsh Verify on GitHub
B AI-triaged 38
A Security

A set by no findings on this axis

A Permissions

A set by no findings on this axis

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 38
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
transparencymedium SD-007
assets/candidate-input.example.json
8 suppressed by AI triage
permission_hygienehigh SD-003 benign_example
references/migration-v3-to-v3.1.md

Documentation snippet uses placeholder relative paths, not actual traversal code.

permission_hygienehigh SD-003 benign_example
references/migration-v3-to-v3.1.md

Same placeholder paths in documentation, no executable traversal.

securityhigh SD-007 benign_example
scripts/fmp_client.py

Only a URL constant is defined, not an executed outbound call or permission grant.

securityhigh SD-007 benign_example
scripts/fmp_client.py

Only a URL constant is defined, not an executed outbound call or permission grant.

securityhigh SD-007 benign_example
scripts/tests/test_capability_cache.py

Test code only stores a URL string in a cache key, no network call is made.

securityhigh SD-007 benign_example
scripts/tests/test_capability_cache.py

URL is used in a disabled endpoints list for testing, not executed.

securityhigh SD-007 benign_example
scripts/tests/test_capability_cache.py

URL appears only as a cache key in test, no real outbound request.

securityhigh SD-007 benign_example
scripts/tests/test_evaluate_candidates.py

The code only assigns a URL string in a test, not performing an outbound network call.