tradingview-api-integration
Fail
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and display news articles and community 'ideas' from TradingView. This content is externally generated and could potentially contain malicious instructions intended to manipulate the AI agent's behavior.
- Ingestion points: Data returned by 'scripts/tv_api.py' when accessing '/api/news/' or '/api/ideas/' endpoints.
- Boundary markers: Absent. The retrieved data is processed and displayed without explicit delimiters or warnings to ignore instructions within the content.
- Capability inventory: The skill has the ability to execute local Python scripts and perform network operations to TradingView domains.
- Sanitization: The skill does not perform explicit filtering or sanitization of the retrieved text before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The main instructions suggest using 'python3 -c' one-liners to query a local OpenAPI JSON file. While this involves runtime code execution, it uses hardcoded templates for data processing rather than executing arbitrary logic.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download the latest API specification from 'https://www.tradingviewapi.com/openapi.json'. This operation targets an official domain associated with the skill's purpose and is used for metadata synchronization, not code execution.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.tradingviewapi.com/openapi.json - DO NOT USE without thorough review
Audit Metadata