finance-markets-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
scripts/crawlora.sh) to wrapcurlcalls to the Crawlora API. The script follows defensive programming practices, includingset -euo pipefailand proper array handling for arguments, effectively preventing common command injection vulnerabilities. - [CREDENTIALS_SAFE]: API authentication is handled via the
CRAWLORA_API_KEYenvironment variable. This is a standard and recommended practice for secret management, avoiding hardcoded credentials in code or documentation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (JSON) from various financial platforms via the Crawlora API.
- Ingestion points: API responses in
scripts/crawlora.shfromapi.crawlora.net. - Boundary markers: None explicitly defined in the script; the data is returned as raw JSON.
- Capability inventory: Subprocess execution via
curlinscripts/crawlora.sh. - Sanitization: Standard JSON handling via
jqis suggested in examples. While external data always poses a theoretical risk of indirect prompt injection, the risk is low given the structured nature of the financial data and the use of a managed vendor API.
Audit Metadata