coil-scan
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches financial data and ticker universes from the TraderDaddy Pro API hosted on Railway (
https://traderdaddy-pro-whop-production.up.railway.app). This is the primary data source for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes ticker symbols and financial metrics from an external API. This represents an ingestion point for untrusted data that could potentially influence agent behavior if it contained malicious instructions.
- Ingestion points: External data is fetched via
urllib.requestin thefetch_bars,fetch_technicals, andfetch_screener_universefunctions withinscripts/coil_scan.py. - Boundary markers: The skill does not currently use specific prompt delimiters or "ignore instructions" warnings when presenting the formatted scan results to the agent.
- Capability inventory: The skill scripts can write result and state files to the
state/andruns/directories. - Sanitization: The script performs basic data validation by attempting to cast price-related fields (high, low, close) to floats, which helps ensure that non-numeric injection payloads are ignored in those fields.
Audit Metadata