moomoo-stock-digest

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves financial news data from a moomoo-owned domain at https://ai-news-search.moomoo.com/news_search to generate its digests.
  • [COMMAND_EXECUTION]: The documentation includes npx commands for users to install or update the skill from the MoomooOpen/moomoo-agent-hub GitHub repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from external news sources, which presents an attack surface for indirect prompt injection.
  • Ingestion points: External news content is retrieved via the GET /news_search API endpoint as described in the workflow.
  • Boundary markers: The skill utilizes a fixed Markdown template and specific constraints to structure the output, although it does not implement explicit delimiters or 'ignore' instructions for the retrieved news content.
  • Capability inventory: The skill identifies capabilities for using curl to fetch data and formatting output. It does not possess automated shell execution or file-writing capabilities during the news processing phase.
  • Sanitization: No specific sanitization or filtering of the retrieved news text is mentioned prior to processing by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 06:54 AM