alpha-vantage
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest and processes untrusted text data from external sources via the Alpha Intelligence endpoints.
- Ingestion points: Untrusted content is fetched through the
NEWS_SENTIMENTandEARNINGS_CALL_TRANSCRIPTfunctions documented inreferences/intelligence.md. - Boundary markers: The implementation examples do not use delimiters or specific instructions to isolate untrusted data from the agent's core instructions.
- Capability inventory: The skill utilizes the
requestslibrary for network retrieval andpandasfor data analysis. - Sanitization: There is no evidence of filtering, escaping, or sanitizing external article content or transcripts before processing.
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of standard, well-known Python packages (
requests,pandas) from the official registry. - [COMMAND_EXECUTION]: The instructions include standard shell commands for setting environment variables (
export ALPHAVANTAGE_API_KEY) to ensure API credentials are not hardcoded, which is a recommended security practice.
Audit Metadata