bingx-sentiment-dashboard
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market sentiment data from Alternative.me, which is a well-known public provider for the Fear & Greed Index. This is a legitimate data source for the skill's purpose.- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runto invoke thecurlbinary for fetching external data and executes several local Python scripts to perform calculations and generate funding heatmaps.- [PROMPT_INJECTION]: The skill ingests data from external APIs which is subsequently interpolated into command-line arguments for analysis scripts. This data flow represents an indirect prompt injection surface, although risk is mitigated by JSON parsing and specific command templates.- [SAFE]: The skill follows read-only principles, explicitly stating it does not place or modify orders. It uses hardcoded base URLs and performs type validation on user-controlled inputs, such as the history limit for sentiment data.
Audit Metadata