currency-rates
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches currency conversion data from Frankfurter (api.frankfurter.dev) and ExchangeRate-API (open.er-api.com). These are well-known services for reference exchange rates.
- [COMMAND_EXECUTION]: Instructs the agent to utilize
curlfor fetching API data. The commands provided as templates are restricted to the legitimate API endpoints mentioned. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external network sources, creating a potential vector for indirect prompt injection.
- Ingestion points: External API responses from
api.frankfurter.devandopen.er-api.com(referenced in SKILL.md). - Boundary markers: Absent; there are no instructions to the agent on how to delimit or ignore instructions that might be embedded in the API responses.
- Capability inventory: Uses
curlfor network operations to retrieve data. - Sanitization: Absent; the skill does not specify validation or sanitization of the JSON payloads returned by the external services.
Audit Metadata