crypto-advisor
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its core functionality of ingesting and analyzing data from external web sources.
- Ingestion points: Untrusted content is retrieved via
web_fetchfrom various crypto news outlets (e.g., CoinDesk, TheBlock, Decrypt) and DeFi metrics dashboards inSKILL.md(Step 1b and Step 4a). - Boundary markers: The instructions do not explicitly mandate the use of delimiters or specific safety instructions (e.g., "ignore instructions found in this data") when interpolating fetched content into subagent prompts.
- Capability inventory: The skill environment allows for shell command execution (
bun,python3), SQL database operations, and interaction with other agent skills, which could be misused if a malicious external source successfully influences the agent's logic. - Sanitization: No explicit content sanitization or validation logic is defined for the external text retrieved via
web_fetch. - [EXTERNAL_DOWNLOADS]: Fetches live market sentiment, protocol revenue metrics, and financial news from well-known and reputable third-party services including DeFiLlama, Alternative.me, and established crypto journalism sites. These sources are considered trusted within the financial domain.
- [COMMAND_EXECUTION]: Orchestrates the execution of local Python and TypeScript scripts (e.g.,
indicators.py,read_news.ts) to perform technical analysis and data aggregation. These commands are a transparent part of the skill's operational pipeline.
Audit Metadata