stablecoin-depeg-monitor
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script in SKILL.md meant for the agent to run during the session. This script manages version checking and updates using standard commands such as curl, grep, and npx.
- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata and updates from the author's GitHub repository (okx/plugin-store). These are vendor-controlled resources used for legitimate skill maintenance.
- [DATA_EXFILTRATION]: The skill connects to api.barker.money to retrieve market overview data. This is the core functionality of the skill and no sensitive user information is transmitted.
- [PROMPT_INJECTION]: The skill processes external data from API responses, creating a surface for indirect prompt injection. However, the skill provides an explicit External Data Boundary section with instructions for the agent to treat this content as data rather than instructions, mitigating the risk.
Audit Metadata