aibtc-news-deal-flow
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified. The skill functions as an editorial tool for formatting news observations.\n- [COMMAND_EXECUTION]: The
compose-signalcommand outputs a suggested shell command for the user to execute. The implementation employs single-quote escaping to prevent command injection from untrusted input in the generated string.\n- [EXTERNAL_DOWNLOADS]: Thecheck-sourcessubcommand performs reachability checks via network requests. These use theHEADmethod with a 5-second timeout and target established vendor infrastructure or well-known services.\n- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it processes untrusted text observations and URLs. This is assessed as safe because the skill does not interpret the content as instructions for its own execution.\n - Ingestion points:
--observationand--sourcesCLI arguments inaibtc-news-deal-flow.ts.\n - Boundary markers: Not present for the free-form text input observations.\n
- Capability inventory: Limited to network metadata checks (HEAD requests) in the source validation logic.\n
- Sanitization: Includes length limits, automated truncation, and shell-safe escaping for generated command outputs.
Audit Metadata