scanning-market-movers

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of standard Python packages requests, pandas, and PyYAML from the official PyPI registry to support market data retrieval and configuration parsing.
  • [DYNAMIC_EXECUTION]: The module scripts/analyzer.py modifies the Python system path at runtime using sys.path.insert to load components from a sibling skill directory (tracking-crypto-prices). This dynamic loading is a documented architectural pattern for this plugin's dependency management.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted asset data (names, symbols, and market stats) from the CoinGecko API. While this data is primarily processed for numeric analysis and displayed in fixed table formats, it represents a potential surface for indirect injection if metadata from the API were crafted to influence agent interpretation.
  • Ingestion points: Fetches market data from https://api.coingecko.com/api/v3/coins/markets in scripts/analyzer.py.
  • Boundary markers: Output is formatted into aligned text tables and structured JSON/CSV exports, providing implicit boundaries between data and instructions.
  • Capability inventory: The skill leverages Read, Write, and Bash tools to manage local settings and generate market reports.
  • Sanitization: Employs yaml.safe_load() for local configuration and transforms API responses into typed numeric fields for significance scoring.
  • [COMMAND_EXECUTION]: The skill executes local Python scripts using the Bash tool to perform scans, calculate significance scores, and format output as requested by the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:48 AM