hhxg-market
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's scripts fetch market data in JSON format from
https://hhxg.top/static/data. This connection to a third-party domain is necessary for the skill to retrieve live financial information. - [COMMAND_EXECUTION]: The skill is configured to use the
Bashtool as stated in its metadata. It instructs the agent to run Python scripts via the shell. Furthermore, thescreenshots/gen_screenshots.pydeveloper script usessubprocess.runto execute other local scripts. - [PROMPT_INJECTION]: The skill processes data from a remote API to generate market summaries, which introduces a surface for indirect prompt injection.
- Ingestion points:
scripts/_common.py(fetching fromhhxg.top). - Boundary markers: None identified in the instructional content.
- Capability inventory:
Bashshell tool access. - Sanitization: Data is consumed and rendered directly without specific sanitization or filtering logic.
Audit Metadata