futu-unusual-derivatives-activity
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could potentially contain malicious instructions.
- Ingestion points: User-supplied stock names or tickers and the resulting data output from the
futuCLI command (SKILL.md). - Boundary markers: The skill instructs the agent to request CLI output in JSON format (
--format json), which provides some structural separation. - Capability inventory: The skill has the ability to execute shell commands via
Bash(SKILL.md). - Sanitization: The skill implements a normalization step that maps user-provided stock names to a strict symbol format (e.g.,
US.NVDA) before they are used in commands, mitigating basic command injection attempts. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute thefutuCLI utility. This is the intended primary functionality for retrieving derivatives market data.
Audit Metadata