alterlab-alpha-vantage
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs legitimate network requests to 'https://www.alphavantage.co' to retrieve financial information. This is consistent with its stated purpose and targets a well-known service provider.
- [EXTERNAL_DOWNLOADS]: Recommends installing the 'requests' and 'pandas' Python packages, which are reputable and standard tools for web requests and data manipulation.
- [DATA_EXFILTRATION]: The code snippets demonstrate retrieving the 'ALPHAVANTAGE_API_KEY' from environment variables, which is a recommended practice for handling API credentials securely.
- [PROMPT_INJECTION]: The skill processes untrusted financial data, such as market news and company overviews, which presents a surface for indirect prompt injection attacks. 1. Ingestion points: Data fetched from Alpha Vantage endpoints like NEWS_SENTIMENT and OVERVIEW. 2. Boundary markers: No delimiters are specified to separate API data from the agent's internal instructions. 3. Capability inventory: The skill has access to the network via 'requests' and environment variables via 'os'. 4. Sanitization: No sanitization of the external strings is evident in the provided code examples.
Audit Metadata