funding-signal-monitor
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs its primary function of monitoring funding signals using established web search tools and the official Algolia API for Hacker News. All network activity is directed toward these well-known services.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to handle secrets like the Apify API token via environment variables (e.g.,
export APIFY_API_TOKEN="..."), preventing accidental hardcoding of credentials. - [COMMAND_EXECUTION]: The skill executes local Python scripts (
search_funding.py,search_twitter.py) to perform its data collection tasks. These scripts are part of the skill's own package structure or its declared dependencies, which is expected behavior for a composite lead-generation tool. - [PROMPT_INJECTION]: The skill ingests untrusted data from web sources (Twitter, Reddit, Hacker News) to qualify leads. While this creates a surface for indirect prompt injection, the skill's current capabilities are limited to ranking data and generating outreach suggestions, which do not pose a high-risk execution path. No instructions to bypass safety filters or override system prompts were found.
- [DATA_EXFILTRATION]: There is no evidence of the skill accessing sensitive local files or transmitting private user data to external servers. Data collection is limited to public funding information.
Audit Metadata