stock-market-data
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing the
longbridgeCLI tool to retrieve various types of financial data. The instructions provide specific subcommands likequote,kline, andipoalong with flags such as--format jsonto ensure the agent interacts with the system in a structured manner. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from external market sources via the CLI tool output.
- Ingestion points: Data is received through the output of various
longbridgesubcommands documented in thereferences/directory, such as real-time quotes, K-line charts, and IPO details. - Boundary markers: The instructions mandate the use of the
--format jsonflag, which encourages the agent to treat the output as structured data rather than free-form text, providing some level of structural delimitation. - Capability inventory: The skill has the capability to execute shell commands (specifically the
longbridgebinary and its subcommands) via subprocess calls. - Sanitization: The instructions in
SKILL.mdandreferences/quote.mdexplicitly direct the agent to normalize user-provided tickers into a specific<CODE>.<MARKET>format (e.g.,NVDA.US), which serves as a validation step for input symbols before they are used in command execution.
Audit Metadata