futu-comment-sentiment

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content (comments and posts) from the Futu community platform, which creates a potential surface for indirect prompt injection.
  • Ingestion points: Fetches community feed data from the https://ai-news-search.futunn.com/stock_feed endpoint (identified in SKILL.md).
  • Boundary markers: The instructions do not specify explicit delimiters (e.g., XML tags or triple quotes) for the analysis of individual posts, although the structured workflow naturally separates data processing from aggregation.
  • Capability inventory: The skill is scoped to information processing, sentiment classification, and summary generation. It does not perform file-system modifications or arbitrary network calls based on data content.
  • Sanitization: The skill mandates cleaning steps including stripping HTML tags from titles and descriptions, filtering low-quality or spammy content, and removing near-empty text before analysis.
  • [COMMAND_EXECUTION]: The skill metadata specifies requirements for system binaries (curl, openssl, date). These tools are used for the primary function of retrieving data from the API and processing timestamps.
  • [EXTERNAL_DOWNLOADS]: The skill connects to ai-news-search.futunn.com to retrieve stock discussion data. This is a legitimate resource belonging to the service provider (Futu) and is necessary for the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 05:39 AM