moomoo-unusual-technical-signal-alerts
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute themoomooCLI for fetching technical signal alerts. This is the primary intended function of the skill. - [EXTERNAL_DOWNLOADS]: The documentation includes
npxcommands to add or update the skill from theMoomooOpen/moomoo-agent-hubrepository. These references target the official infrastructure of the skill's author. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied stock targets which are interpolated into shell commands.
- Ingestion points: User-provided stock names, company names, or tickers are extracted from the prompt in
SKILL.md. - Boundary markers: The instructions explicitly require the agent to normalize input into a standard market-prefixed symbol (e.g.,
US.NVDA) before invoking the CLI. - Capability inventory: The skill has the capability to execute shell commands via
moomoo unusual technical-signalsusing theBashtool. - Sanitization: The skill provides a comprehensive normalization workflow, including a mapping table for common stocks and instructions to ask for clarification if the input is ambiguous, effectively mitigating the risk of command injection from untrusted input.
Audit Metadata