trading-agents
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The analyst components (news, market, fundamentals, and social analysts) fetch data from the Alpha Vantage API using
curl. Alpha Vantage is a well-known service for financial market data. The skill also references an external GitHub repository (TauricResearch/TradingAgents) which serves as the conceptual basis for the workflow. - [COMMAND_EXECUTION]: The analyst markdown files instruct the agent to use
curlcommands to retrieve financial data in CSV and JSON formats from external API endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted data from the web.
- Ingestion points: The
news-analyst.mdandsocial-analyst.mdfiles fetch and processNEWS_SENTIMENTdata, which contains external headlines and summaries from various news and social media sources. - Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded instructions within the fetched news data.
- Capability inventory: The skill writes multiple markdown reports to the local file system (
report/directory) and performs network requests viacurlto fetch data. - Sanitization: The skill does not mention specific sanitization or filtering of the retrieved external content before it is processed by the agent.
Audit Metadata