toss-portfolio-state
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMPERSISTENCEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: scripts/remote_portfolio_snapshot.ts modifies the local ~/.ssh/config file and generates a dedicated Ed25519 key pair to maintain access to a home server.
- [REMOTE_CODE_EXECUTION]: The skill deploys and executes scripts on a user-defined remote server via scp and ssh commands.
- [COMMAND_EXECUTION]: System binaries such as ssh, scp, and ssh-keygen are invoked via Bun.spawn to manage remote configuration.
- [DYNAMIC_EXECUTION]: A remote execution path decodes Base64-encoded payloads into command-line arguments for dynamic process spawning.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting external data from Toss Invest. Evidence chain: 1. Ingestion: API data in fetch_portfolio_snapshot.ts. 2. Boundaries: Trust boundary defined in snapshot-contract.md. 3. Capabilities: Network access, local file modification, and remote SSH execution. 4. Sanitization: Redaction of tokens and strict schema enforcement.
- [EXTERNAL_DOWNLOADS]: Runtime retrieval of the Toss OpenAPI JSON specification for coverage validation.
Audit Metadata