yield-strategy-advisor
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API, creating a surface for potential injection attacks.\n
- Ingestion points: Fetches live yield data from Barker's API at
api.barker.money/api/public/v1/defi/vaults.\n - Boundary markers: The skill includes a dedicated "External Data Boundary" section instructing the agent to treat API responses as untrusted data and not to execute embedded instructions.\n
- Capability inventory: The skill is focused on data presentation and does not request high-privilege capabilities or tools for file system modification.\n
- Sanitization: Instructions guide the agent to render strings as data and avoid following imperative text in API response fields.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve financial data and verify its version.\n
- Fetches yield strategy information from the vendor's API at
api.barker.money.\n - Performs a read-only version check against the author's public GitHub repository at
raw.githubusercontent.com.
Audit Metadata