tracking-crypto-derivatives
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it ingests data from external cryptocurrency exchange APIs (Binance, Bybit, OKX, Deribit, BitMEX) and provides it to the agent context. However, the data source is limited to financial market data, which is low-risk for containing malicious instructions.\n
- Ingestion points:
derivatives_tracker.pyprocesses data from exchange APIs via theexchange_client.pymodule.\n - Boundary markers: Data is formatted into ASCII tables and structured JSON via
scripts/formatters.py.\n - Capability inventory:
Read,Write,Edit,Grep,Glob,Bash.\n - Sanitization: The skill normalizes numerical data into Decimal types but does not explicitly sanitize raw strings from the APIs.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch real-time derivatives data from well-known services including Binance, Bybit, OKX, Deribit, and BitMEX. These operations are essential for the skill's primary function and target established financial service providers.
Audit Metadata