stocks
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Retrieves financial data and market information from well-known services including Yahoo Finance and Alpha Vantage. These connections are necessary for the skill's primary purpose and use established APIs.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external web sources such as stock names, descriptions, and search results. While this represents a theoretical attack surface where malicious content from the source could influence the agent, the risk is minimal given the reputable nature of the sources.
- Ingestion points:
scripts/stocks_client.py(viayf_search,yf_chart, andyf_quote_summaryfunctions). - Boundary markers: None; the tool returns structured JSON data for the agent to process.
- Capability inventory: The agent executes the script through the
terminaltool. - Sanitization: The script correctly uses JSON parsing and URL encoding but does not perform specific content filtering on textual metadata fields like company names or descriptions.
Audit Metadata