futu-news-search
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the system
curlbinary to perform network requests to the Futu news search API. It also requiresopensslanddatefor data processing and timestamp formatting. - [EXTERNAL_DOWNLOADS]: The skill fetches data from
https://ai-news-search.futunn.com/news_search. This domain is an official resource associated with the vendor Futu. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and displays external news content. 1. Ingestion points: Data is received from the
/news_searchAPI endpoint (file: SKILL.md). 2. Boundary markers: The ingested content is placed within a fixed markdown template to separate it from agent instructions. 3. Capability inventory: The skill's capabilities are limited to information retrieval and display; it does not perform file writes or execute code derived from the news results. 4. Sanitization: User-provided search keywords are URL-encoded using the--data-urlencodeflag incurlto prevent injection into the API request.
Audit Metadata