longbridge-catalyst-radar

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on executing the longbridge CLI tool with various subcommands (e.g., quote, capital, watchlist) to perform market scans and data retrieval. This is a primary function of the skill for interacting with the local environment.
  • [EXTERNAL_DOWNLOADS]: Market data and signals are fetched from the official MCP endpoint https://openapi.longbridge.com/mcp and through web searches for policy interpretation. These interactions are consistent with the skill's purpose and the author's identity.
  • [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it analyzes external content such as news articles, analyst ratings, and regulatory filings. Malicious instructions embedded in these sources could potentially influence the agent's behavior, as there are no explicit sanitization routines or boundary markers (e.g., delimiters) described to isolate untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 02:19 PM