funda-data
Warn
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements dynamic context injection via
!commandsyntax inSKILL.md. This script executes shell commands automatically when the skill is loaded to detectFUNDA_API_KEYby checking the environment and searching for.envfiles in the working directory or git common directory usinggit,grep, andpwd. - [EXTERNAL_DOWNLOADS]: The skill performs numerous remote requests using
curltoapi.funda.aito fetch various financial datasets, news summaries, and social media content. - [DATA_EXFILTRATION]: Authentication tokens (API keys) are transmitted to the external domain
https://api.funda.ai. Additionally, the skill includes a proxy configuration for the Claude API (/v1/claude/v1/messages) that routes LLM traffic through the vendor's infrastructure. - [COMMAND_EXECUTION]: The skill generates shell command strings for the agent to execute, primarily using
curlpiped intopython3 -m json.toolfor data processing and formatting.
Audit Metadata