quaq-ingest
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to ingest and process data from external, untrusted sources.
- Ingestion points: The skill reads local files (e.g., 'tradingview_export.csv', 'tv_export.csv') and fetches data from external REST APIs (e.g., 'https://api.example.com/ohlcv').
- Boundary markers: There are no explicit boundary markers or instructions to ignore potential instructions embedded within the data in the provided Python snippets.
- Capability inventory: The skill can write data to the filesystem ('to_csv'), make external network requests ('requests.get'), and execute code via CLI ('python -c', 'zig build run').
- Sanitization: While the skill documentation provides a manual validation checklist for the user, the provided code templates do not include automated input validation or sanitization logic.
- [COMMAND_EXECUTION]: The skill provides instructions for executing Python code directly through the command line ('python -c') for data conversion tasks and running the 'zig build run' command to validate strategy configurations.
- [EXTERNAL_DOWNLOADS]: The skill facilitates fetching data from external network resources, specifically referencing the Binance REST API and providing templates for connecting to arbitrary third-party APIs using the 'requests' library.
Audit Metadata