market
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
api.aisa.oneto retrieve financial data, news, and filings. This domain is the official API endpoint for the skill's author,aisa-team. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (news articles and SEC filings) which could theoretically contain malicious instructions designed to influence the agent's behavior.
- Ingestion points:
scripts/market_client.py(via news, filings, and facts endpoints). - Boundary markers: Data is returned as raw JSON; no specific delimiters or instructions are provided to the agent to treat this content as untrusted.
- Capability inventory: The skill's capabilities are limited to network GET/POST requests; it lacks the ability to write to the local file system or execute arbitrary shell commands.
- Sanitization: The content retrieved from the API is passed directly to the agent without sanitization.
Audit Metadata