Skills
Navigate
skills/bobibobuyu/wind-skills-test/mx-finance-data/Gen Agent Trust Hub

mx-finance-data

Fail

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill includes a hardcoded default API key within its main execution script.
  • Evidence: DATA_SERVICE_KEY = os.environ.get("EM_API_KEY", "em_eaRnxyWlMUiriR0Tj2m79QtUtxjTU0hQ").strip() in scripts/get_data.py.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection due to its handling of external API data.
  • Ingestion points: External financial data is retrieved from https://ai-saas.eastmoney.com/proxy/b/mcp/tool/searchData in scripts/get_data.py.
  • Boundary markers: There are no delimiters or specific instructions provided to the agent to disregard potential instructions embedded within the retrieved financial data.
  • Capability inventory: The skill has the capability to write files (.xlsx and .txt) to the local filesystem using pandas and Path.write_text in scripts/get_data.py.
  • Sanitization: No sanitization, filtering, or validation is performed on the data returned from the API before it is processed and written to disk.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 11, 2026, 11:58 AM