longbridge-catalyst-radar
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing the
longbridgeCLI tool with various subcommands (e.g.,quote,capital,watchlist) to perform market scans and data retrieval. This is a primary function of the skill for interacting with the local environment. - [EXTERNAL_DOWNLOADS]: Market data and signals are fetched from the official MCP endpoint
https://openapi.longbridge.com/mcpand through web searches for policy interpretation. These interactions are consistent with the skill's purpose and the author's identity. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it analyzes external content such as news articles, analyst ratings, and regulatory filings. Malicious instructions embedded in these sources could potentially influence the agent's behavior, as there are no explicit sanitization routines or boundary markers (e.g., delimiters) described to isolate untrusted data.
Audit Metadata