market-top-detector
Fail
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is configured to automatically download data from
https://tradermonty.github.io/market-breadth-analysis/market_breadth_data.csv. This specific URL has been blacklisted by automated security scanners for serving malicious content.\n- [REMOTE_CODE_EXECUTION]: Automated scanners have flagged the filescripts/breadth_csv_client.pyas a malicious file (FileRepMalware). This script facilitates the download and processing of data from a blacklisted source, presenting a high risk of malware delivery or malicious code execution if the external resource is compromised.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, untrusted sources which could be used to influence the AI agent's behavior.\n - Ingestion points: The CSV data fetched from
tradermonty.github.ioand API responses from Financial Modeling Prep (FMP).\n - Boundary markers: There are no explicit instructions to the AI agent to ignore potential instructions embedded within this external data or to treat it as data only.\n
- Capability inventory: The skill can perform network requests (
requests.get) and write local files to thereports/directory.\n - Sanitization: While numerical parsing is present for specific fields, there is no validation of the overall content structure to prevent instructions from entering the agent's context via non-numerical columns or corrupted file structure.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata