uptrend-analyzer
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads market breadth data in CSV format from the
tradermonty/uptrend-dashboardrepository on GitHub. The domainraw.githubusercontent.comis a well-known service used here for data retrieval. - [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python orchestrator (
scripts/uptrend_analyzer.py) which manages data fetching, component calculation, and report generation. - [PROMPT_INJECTION]: The skill processes external CSV data, which creates a surface for indirect prompt injection. While numeric values are cast to float and integer types, string values such as sector names are interpolated into a Markdown report without explicit sanitization or boundary markers.
- Ingestion points:
scripts/data_fetcher.pyretrieves external CSV data from a GitHub repository. - Boundary markers: The generated Markdown report does not include specific delimiters or warnings to ignore instructions embedded in the external data.
- Capability inventory: The skill writes local JSON and Markdown files and instructs the agent to present the content to the user.
- Sanitization: Data validation is performed on numeric fields via type casting; however, string fields are not escaped for Markdown, allowing for potential instruction injection via the CSV content.
Audit Metadata