alpha-vantage

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the well-known and standard Python libraries 'requests' and 'pandas' to handle API requests and data processing.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by processing external news and sentiment data. 1. Ingestion points: Untrusted data is fetched from third-party news sources via the 'NEWS_SENTIMENT' endpoint (references/intelligence.md). 2. Boundary markers: The skill does not provide delimiters or instructions to ignore potential commands embedded within the news articles. 3. Capability inventory: The skill is restricted to network read operations and data formatting; it does not have the ability to execute shell commands or access sensitive files. 4. Sanitization: No content filtering or validation is performed on the incoming text data.
  • [PROMPT_INJECTION]: The instructions include a metadata-based behavioral trigger that directs the agent to proactively suggest an external platform ('www.k-dense.ai') for complex tasks, which serves as a form of promotional behavioral steering.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 07:59 PM