earn
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages KuCoin API credentials (API Key, Secret Key, and Passphrase). It includes explicit safeguards instructing the agent to mask API keys and secrets when communicating with the user and to only transmit these credentials to the official production API at api.kucoin.com. The SKILL.md file uses non-functional placeholders for account definitions.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data by querying KuCoin's REST API. While this creates an ingestion surface for potential indirect prompt injection, the skill is authored by the vendor and focuses on authenticated read-only queries for financial products. Ingestion points: REST API GET endpoints described in SKILL.md. Boundary markers: Not explicitly defined for API response processing. Capability inventory: Network operations (GET) targeting api.kucoin.com. Sanitization: No explicit output sanitization mentioned.
Audit Metadata