alpha-vantage

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingest and processes untrusted text data from external sources via the Alpha Intelligence endpoints.
  • Ingestion points: Untrusted content is fetched through the NEWS_SENTIMENT and EARNINGS_CALL_TRANSCRIPT functions documented in references/intelligence.md.
  • Boundary markers: The implementation examples do not use delimiters or specific instructions to isolate untrusted data from the agent's core instructions.
  • Capability inventory: The skill utilizes the requests library for network retrieval and pandas for data analysis.
  • Sanitization: There is no evidence of filtering, escaping, or sanitizing external article content or transcripts before processing.
  • [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of standard, well-known Python packages (requests, pandas) from the official registry.
  • [COMMAND_EXECUTION]: The instructions include standard shell commands for setting environment variables (export ALPHAVANTAGE_API_KEY) to ensure API credentials are not hardcoded, which is a recommended security practice.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:44 PM