make-me-money-trading
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches health status and scoreboard data from the vendor's official domain at
edgeverdict.ioand a service endpoint on Google Cloud Run. - [REMOTE_CODE_EXECUTION]: The documentation includes an installation command using
npxto fetch and add the skill from the vendor's namespace (edgeverdict/edgeverdict-make-me-money-trading). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential vulnerability surface by ingesting external data during execution.
- Ingestion points: The skill retrieves JSON data from
https://edgeverdict.io/receipts.json(referenced in SKILL.md). - Boundary markers: There are no explicit delimiters or instructions defined to prevent the agent from following embedded instructions within the JSON data.
- Capability inventory: The skill's functionality is restricted to read-only API calls and it explicitly forbids trade execution, custodial operations, or strategy source code disclosure.
- Sanitization: No explicit sanitization or schema validation for the ingested JSON content is documented.
Audit Metadata