scanning-market-movers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of standard Python packages
requests,pandas, andPyYAMLfrom the official PyPI registry to support market data retrieval and configuration parsing. - [DYNAMIC_EXECUTION]: The module
scripts/analyzer.pymodifies the Python system path at runtime usingsys.path.insertto load components from a sibling skill directory (tracking-crypto-prices). This dynamic loading is a documented architectural pattern for this plugin's dependency management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted asset data (names, symbols, and market stats) from the CoinGecko API. While this data is primarily processed for numeric analysis and displayed in fixed table formats, it represents a potential surface for indirect injection if metadata from the API were crafted to influence agent interpretation.
- Ingestion points: Fetches market data from
https://api.coingecko.com/api/v3/coins/marketsinscripts/analyzer.py. - Boundary markers: Output is formatted into aligned text tables and structured JSON/CSV exports, providing implicit boundaries between data and instructions.
- Capability inventory: The skill leverages
Read,Write, andBashtools to manage local settings and generate market reports. - Sanitization: Employs
yaml.safe_load()for local configuration and transforms API responses into typed numeric fields for significance scoring. - [COMMAND_EXECUTION]: The skill executes local Python scripts using the
Bashtool to perform scans, calculate significance scores, and format output as requested by the user.
Audit Metadata