alphagbm-vol-surface
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted ticker symbols provided by users, which are interpolated into external API request paths.\n
- Ingestion points: Symbol parameter in
GET /api/options/tools/vol-surface/<SYMBOL>and snapshot endpoints as defined inSKILL.md.\n - Boundary markers: No explicit delimiters or boundary instructions are provided to separate user-supplied ticker symbols from the rest of the request logic.\n
- Capability inventory: The skill performs network GET requests to fetch volatility and market data.\n
- Sanitization: The skill documentation does not specify input validation or sanitization for ticker symbols.\n- [EXTERNAL_DOWNLOADS]: The skill fetches financial data from the vendor's infrastructure to perform analysis.\n
- Evidence: Network requests are directed to the official vendor domain at
https://alphagbm.zeabur.app.
Audit Metadata