moomoo-stock-digest
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves financial news data from a moomoo-owned domain at
https://ai-news-search.moomoo.com/news_searchto generate its digests. - [COMMAND_EXECUTION]: The documentation includes
npxcommands for users to install or update the skill from theMoomooOpen/moomoo-agent-hubGitHub repository. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from external news sources, which presents an attack surface for indirect prompt injection.
- Ingestion points: External news content is retrieved via the
GET /news_searchAPI endpoint as described in the workflow. - Boundary markers: The skill utilizes a fixed Markdown template and specific constraints to structure the output, although it does not implement explicit delimiters or 'ignore' instructions for the retrieved news content.
- Capability inventory: The skill identifies capabilities for using
curlto fetch data and formatting output. It does not possess automated shell execution or file-writing capabilities during the news processing phase. - Sanitization: No specific sanitization or filtering of the retrieved news text is mentioned prior to processing by the agent.
Audit Metadata