academy-skill
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: No malicious behavior, obfuscation, or safety bypass attempts were detected across the skill's instructions, scripts, or reference documentation.
- [COMMAND_EXECUTION]: The skill invokes a local Node.js script (scripts/academy-api.mjs) using the Bash tool to facilitate API requests and data processing.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied queries and external API responses from binance.com. This surface is mitigated via query preprocessing and response sanitization. 1. Ingestion points: User query and Academy API data (e.g. bodyTextOnly, excerpt). 2. Boundary markers: Skill instructions mandate the use of markdown templates and require paraphrasing. 3. Capability inventory: Uses Bash and Read tools. 4. Sanitization: Pre-processes queries to strip control characters and provides a stripHtml utility for responses.
- [DYNAMIC_EXECUTION]: The skill utilizes node -e with an import statement to invoke internal data-cleaning functions (like stripHtml) from its own script files at runtime.
Audit Metadata