api-data-fetcher

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external APIs (FRED, World Bank, BLS, OECD, Yahoo Finance), representing a potential surface for indirect prompt injection.
  • Ingestion points: Data is ingested via the fetch_fred_series and fetch_world_bank_data functions in SKILL.md and index.md.
  • Boundary markers: The skill does not explicitly use delimiters or boundary markers for the fetched data, though it is processed as structured tabular data (Pandas DataFrames).
  • Capability inventory: The generated code includes the capability to write data to the local file system using pd.to_csv().
  • Sanitization: Data is cleaned and formatted into DataFrames, but there is no explicit sanitization for LLM injection within the data content itself.
  • [EXTERNAL_DOWNLOADS]: The skill generates code designed to download macroeconomic data from well-known and trusted services including the Federal Reserve Economic Data (FRED) and the World Bank.
  • [COMMAND_EXECUTION]: The documentation provides standard instructions for installing necessary Python dependencies (fredapi, wbdata, pandas) using the system's package manager.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 10:39 PM