investor-lyn-alden
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes several TypeScript scripts (
fetch_blog.ts,fetch_x.ts,fetch_nostr.ts) that use thefetchAPI and WebSockets to retrieve data from external domains. These includelynalden.com,twitter.com,archive.org, and public Nostr relays (primal.net,damus.io,nos.lol). These connections are necessary for the skill's primary purpose of providing up-to-date analysis. - [COMMAND_EXECUTION]: The
SKILL.mdfile instructs the agent to run local TypeScript scripts using thebunruntime (e.g.,bun .agents/skills/investor-lyn-alden/scripts/current_context.ts). These scripts are provided with the skill and are used to aggregate data for the agent's context. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external social media feeds and RSS feeds.
- Ingestion points: External data is fetched via
scripts/fetch_blog.ts,scripts/fetch_x.ts, andscripts/fetch_nostr.tsand returned to the agent. - Boundary markers: The orchestrator script (
current_context.ts) organizes fetched content under clear Markdown headers (e.g., '## X (@LynAldenContact)'). - Capability inventory: The agent uses this data to answer user questions and synthesize conclusions. The skill does not grant the agent high-privilege write access or execution capabilities based on this data.
- Sanitization: The scripts perform basic cleaning, such as stripping HTML tags and decoding entities, to treat the fetched content as raw text rather than executable instructions.
Audit Metadata