moomoo-news-search
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests updating or adding the skill via
npxfrom a public repository (MoomooOpen/moomoo-agent-hub). This is a standard package management workflow for the developer platform and targets the author's own official hub. - [COMMAND_EXECUTION]: The skill uses
curlto interact with a legitimate, vendor-specific API endpoint (ai-news-search.moomoo.com). The instructions explicitly recommend using--data-urlencodeto prevent command injection or malformed request issues when handling user-provided keywords. - [INDIRECT_PROMPT_INJECTION]: The skill processes external news data (titles, URLs). It mitigates risks by explicitly instructing the agent to perform 'INFORMATION RETRIEVAL ONLY' and strictly forbids interpretation, summarization, or investment advice, which limits the impact of potentially poisoned external content.
- [DATA_EXFILTRATION]: No sensitive local data access (such as credentials or environment variables) was detected. The network operations are limited to a specific vendor-owned domain for search purposes.
Audit Metadata