alphagbm-duan-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Comprehensive analysis of the instructions and metadata shows no evidence of prompt injection, obfuscation, or persistence mechanisms. The skill documentation is consistent with its stated financial purpose.
- [DATA_EXPOSURE]: All external references, including the API endpoint and the homepage URL, belong to the author's verified domain (alphagbm.com). No hardcoded credentials or sensitive system file paths were found.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided input for ticker symbols and purchase prices. 1. Ingestion points: 'ticker' and 'buy_price' parameters defined in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: The skill uses these inputs to query a specific financial API at alphagbm.com. 4. Sanitization: The documentation does not specify sanitization or validation logic for these inputs. While this represents a potential attack surface, the risk is limited by the structured nature of the financial API interaction.
Audit Metadata