trader-alerts
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches stock price data from well-known financial services including Yahoo Finance (
query1.finance.yahoo.com) and Stooq (stooq.com). These network operations are limited to retrieving delayed market quotes in JSON and CSV formats. - [INDIRECT_PROMPT_INJECTION]: The skill represents a potential surface for indirect prompt injection because it ingests data from external websites.
- Ingestion points: Data is fetched via
urllib.requestinalerts.pyfrom external quote providers. - Boundary markers: The tool uses structured labels like
ALERTand formatted tables to delimit output, providing some context to the agent. - Capability inventory: The skill has the ability to read and write local JSON files (
trader/alerts.json,trader/prices.json) and make network GET requests. - Sanitization: The script performs specific parsing of JSON and CSV data, extracting only numeric price values and metadata, which significantly limits the risk of the LLM interpreting fetched data as instructions.
Audit Metadata