
Is Valuein — SEC EDGAR Fundamentals & Smart-Money Data safe?
Probably. Read the findings first.
Use with care. Some checks failed or could not be verified.
What to know before installing
- highWrite-action tools reachable without authentication
Public scan report
scanner v0.1.2 · 2026-09-18 · same rubric, same numbers if you re-run it
1 high1 medium1 low
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 6802ms12/20
- Tool poisoning121 tool descriptions checked8/15
- Auth qualityopen endpoint exposes 36 write-action tools with no auth3/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Findings (3)
- highWrite-action tools reachable without authentication
auth.open-write - lowUnusually long tool description (over 2,000 characters)
poison.long-descriptiontool search_companies: …Search for US public companies by name, ticker symbol, CIK (SEC identifier), or SIC industry code. Returns ticker, company name, sector, industry, exchange, and current S&P 500 membership status. Use this tool to resolve a company name to ticker/CIK before calling `get_company_fundamentals`, `get_valuation_metrics`, or other tools that require a ticker — they do not fuzzy-match company names. **Use this tool — NOT `get_pit_universe` — when the user asks about CURRENT S&P 500 members.** To list current S&P 500 members, call `search_companies({ is_sp500: true })` (the `is_sp500` filter is itself a valid search parameter, so no other input is required). This returns the live snapshot as of query time. Example: "List 5 current S&P 500 members" → call `search_companies({ is_sp500: true, limit: 5 })`. **Use `get_pit_universe` ONLY when the user explicitly needs a survivorship-free historical universe as of a specific past date** (e.g. "S&P 500 members as of March 2018"). If the user says "current," "today," "now," or gives no date, use `search_companies` instead. **One ticker can return two rows.** A CIK identifies a *registrant*, not a company, so a reincorporation or holdco reorganisation moves the ticker to a NEW CIK while the filing history stays under the old one. Both rows are real. Use `is_active` to tell them apart: `true` is the current listing, `false` is the superseded one and carries `listed_until`. Prefer `is_active` over `status` — `status` is an entity-level flag that is unreliable in both directions. **Data details:** `sic_code` is the 4-digit SIC; `industry` is the human-readable label. `sector` is SIC-derived with GICS-style labels — NOT licensed GICS, so industrial conglomerates may map differently from official GICS (e.g. 3M → 'Health Care' by SIC vs Industrials by GICS). S&P 500 membership is sourced from index_membership.parquet (current SP500 = `index_name='SP500' AND removal_date IS NULL`). Available on all plans. **CIK is the canonical, stable identifier — prefer it for backtests and archival work.** A ticker can be retired and later RECYCLED to an unrelated company (DEC is now Diversified Energy, AMR is Alpha Metallurgical, ARC is a document company today), so a ticker-only reference can silently drift to the wrong issuer years later. A purely-numeric `query` (or the dedicated `cik` param) resolves by CIK. Every company-scoped tool (`get_company_fundamentals`, `get_financial_ratios`, `get_stock_price`, etc.) accepts the `cik` this tool returns in place of `ticker` — carry it forward across a multi-step workflow instead of re-resolving by ticker each call. `include_inactive` defaults to `true`: this is a survivorship-free product, so delisted/superseded listings are never hidden by default.… - mediumMixed-script characters that can hide text
poison.homoglyphtool get_capital_allocation_profile: …dividends + buybacks + debt repayment + Δcash). The `flags` object carries pre-comput…
Overall 63/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON