trader-entry
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches real-time market data from Yahoo Finance (query1.finance.yahoo.com and query2.finance.yahoo.com). This is a well-known service and the fetch operation is necessary for the skill's primary function of monitoring price entries.
- [COMMAND_EXECUTION]: The instructions direct the agent to execute a local Python script (entry.py) to perform data processing and monitoring tasks. This is standard behavior for an agent skill and does not involve arbitrary command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Yahoo Finance API and local files. Ingestion points: entry.py fetches data from Yahoo Finance via urllib.request.urlopen and reads trader/watchlist.json and trader/config.json. Boundary markers: Absent in raw Yahoo Finance data; logic is scoped within the Python script's internal evaluation rules. Capability inventory: entry.py can write to trader/entry.json and perform network reads; no subprocess, exec, or eval calls are present in the script. Sanitization: Present; data is parsed as JSON, and stock symbols are sanitized before being used in URL construction.
Audit Metadata