futu-news-search

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the system curl binary to perform network requests to the Futu news search API. It also requires openssl and date for data processing and timestamp formatting.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from https://ai-news-search.futunn.com/news_search. This domain is an official resource associated with the vendor Futu.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and displays external news content. 1. Ingestion points: Data is received from the /news_search API endpoint (file: SKILL.md). 2. Boundary markers: The ingested content is placed within a fixed markdown template to separate it from agent instructions. 3. Capability inventory: The skill's capabilities are limited to information retrieval and display; it does not perform file writes or execute code derived from the news results. 4. Sanitization: User-provided search keywords are URL-encoded using the --data-urlencode flag in curl to prevent injection into the API request.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 05:39 AM