market-event-impact
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches official economic calendars and meeting schedules from trusted government and central bank domains, including federalreserve.gov (US), ecb.europa.eu (EU), and bok.or.kr (South Korea).
- [COMMAND_EXECUTION]: The skill instructions utilize
npxto execute vendor-specific CLI tools (@nomadamas/k-skill) for retrieving instructions, managing files, and performing updates. These are recognized as legitimate vendor-owned resources for the author 'nomadamas'. - [INDIRECT_PROMPT_INJECTION]: The skill processes external market data and research narratives supplied via JSON or CSV files. While this creates an ingestion surface for untrusted data, the risk is highly mitigated by strict programmatic validation, schema enforcement (e.g., in
scripts/market_data.pyandscripts/research.py), and the use of deterministic financial logic rather than immediate interpolation into LLM prompts. - [DATA_EXFILTRATION]: No patterns of sensitive data access (such as reading credentials or SSH keys) or unauthorized network exfiltration were found. Network activity is limited to fetching public financial calendars.
- [DYNAMIC_EXECUTION]: The skill performs complex calculations and calendar alignments using Python scripts. The logic is self-contained and does not use unsafe execution patterns like
eval()orexec()on external data.
Audit Metadata