market-breadth-analyzer
Fail
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Automated security scanners have detected malicious signatures in several core script files included with the skill. Detection alerts for 'FileRepMalware' were issued for 'scripts/csv_client.py' and 'scripts/report_generator.py'. These files are executed as part of the skill's primary workflow, posing a significant risk of arbitrary code execution from flagged sources.\n- [EXTERNAL_DOWNLOADS]: The skill connects to and downloads data from external URLs that are blacklisted. Security scans identified 'tradermonty.github.io/market-breadth-analysis/' and its associated CSV data files as malicious. The skill relies on these sources for its core analysis functionality, leading to the ingestion of content from untrusted and flagged infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates a vulnerability surface for indirect prompt injection by processing external data without sufficient boundary protections.\n
- Ingestion points: External data is fetched from flagged URLs and parsed in 'scripts/csv_client.py'.\n
- Boundary markers: The skill does not employ explicit instructions or delimiters to isolate data from instructions in its generated reports.\n
- Capability inventory: The agent environment is granted permissions to execute Python scripts, perform network operations, and write reports to the filesystem.\n
- Sanitization: While the script performs type casting for numeric values in 'scripts/csv_client.py', the reliance on high-risk domains for data input remains a concern.
Recommendations
- CRITICAL: 4 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 6 malicious URL(s) - DO NOT USE
Audit Metadata