kelly-invest-stock
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill follows security best practices, including a comprehensive automated check script (
check.mjs) that validates dependency versions and searches for sensitive patterns like hardcoded credentials or unauthorized browser storage usage. - [COMMAND_EXECUTION]: Includes administrative scripts for workspace setup (
setup.mjs) and application publishing (publish_airapp.mjs). These tools are intended for deployment and configuration management by the agent/developer. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content such as strategy theses and research evidence. While the application implements HTML escaping to mitigate injection risks in the UI, the ingestion of unstructured text from a database represents a potential surface for indirect prompt injection.
- [EXTERNAL_DOWNLOADS]: Utilizes the
stock-sdklibrary to fetch market data from public sources. Security controls within the skill documentation and automated checks ensure that this library is only executed in trusted environments and not within the client-side browser code.
Audit Metadata