openalgo-chart-terminal
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of a trading terminal that processes untrusted external data from market feeds. While standard for trading applications, this represents a potential surface for indirect prompt injection.
- Ingestion points: External data enters the agent's context through OpenAlgoLiveDataFeed and WebSocket connections defined in SKILL.md.
- Boundary markers: There are no instructions for implementing boundary markers or 'ignore' instructions for data retrieved from external trading APIs.
- Capability inventory: The skill implementation involves network communication with brokers/exchanges and local file system persistence via browser storage (localStorage).
- Sanitization: The instructions do not include specific steps for sanitizing or validating external ticker symbols, indicator settings, or market depth data before processing.
Audit Metadata