crypto-research
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's functionality is limited to aggregating public market data from CoinMarketCap. All tool calls and URLs are consistent with the stated purpose of cryptocurrency research.
- [CREDENTIALS_UNSAFE]: The configuration instructions correctly use placeholders ('your-api-key') instead of hardcoding secrets. This is standard documentation practice and poses no security risk.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it processes untrusted content such as news headlines and project descriptions from external API calls. Ingestion points: Content retrieved via 'get_crypto_info' and 'get_crypto_latest_news'. Boundary markers: Absent. Capability inventory: The skill only has access to data retrieval tools and cannot perform file system operations, shell execution, or unauthorized network requests. Sanitization: Not observed in the instruction set. The risk is minimized by the skill's restricted capability scope.
Audit Metadata