ito-baskets
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is strictly limited to indexing, comparing, and briefing market data. It contains explicit non-negotiable boundaries that prohibit order execution, investment advice, or any state-changing operations.
- [COMMAND_EXECUTION]: Data retrieval is handled via a local script
scripts/ito-baskets.js. The script is dependency-free, uses only Node.js built-ins, and is restricted to making GET requests. It includes validation logic to ensure API base URLs use HTTPS and targets only the official vendor domain. - [PROMPT_INJECTION]: The skill handles an indirect prompt injection surface by ingesting untrusted data from the Itô Markets API and user-supplied research notes. However, it mitigates this risk by instructing the agent to treat fetched content as untrusted, ignore embedded instructions, and perform Unicode NFKC normalization on inputs.
Audit Metadata