convert
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting data from the KuCoin API. 1. Ingestion points: Response data from the api.kucoin.com endpoints defined in SKILL.md. 2. Boundary markers: No explicit delimiters or boundary markers are defined for the received API data. 3. Capability inventory: Network requests (via tools) to retrieve symbols, quotes, and order history. 4. Sanitization: No specific sanitization or validation logic is provided for the response content.
- [SAFE]: The skill includes robust safety instructions for the agent to protect user credentials, including specific masking formats for API keys and secrets and instructions to never exfiltrate keys to third-party domains.
- [SAFE]: Examples in SKILL.md use non-functional placeholders ('your_api_key', 'your_api_secret') rather than real credentials, presenting no security risk.
Audit Metadata