moomoo-unusual-technical-signal-alerts

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute the moomoo CLI for fetching technical signal alerts. This is the primary intended function of the skill.
  • [EXTERNAL_DOWNLOADS]: The documentation includes npx commands to add or update the skill from the MoomooOpen/moomoo-agent-hub repository. These references target the official infrastructure of the skill's author.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied stock targets which are interpolated into shell commands.
  • Ingestion points: User-provided stock names, company names, or tickers are extracted from the prompt in SKILL.md.
  • Boundary markers: The instructions explicitly require the agent to normalize input into a standard market-prefixed symbol (e.g., US.NVDA) before invoking the CLI.
  • Capability inventory: The skill has the capability to execute shell commands via moomoo unusual technical-signals using the Bash tool.
  • Sanitization: The skill provides a comprehensive normalization workflow, including a mapping table for common stocks and instructions to ask for clarification if the input is ambiguous, effectively mitigating the risk of command injection from untrusted input.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 06:55 AM