alphaear-deepear-lite
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches financial signals and analysis from https://deepear.vercel.app/latest.json. This resource is hosted on Vercel and serves as the primary data source for the skill's intended functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes financial signals and reasoning from an external API, creating a surface for indirect prompt injection. 1. Ingestion points: Data is retrieved via HTTP GET in scripts/deepear_lite.py. 2. Boundary markers: Absent. The fetched data is interpolated into a report without specific delimiters or instructions for the agent to ignore embedded commands. 3. Capability inventory: No dangerous capabilities such as file system access or command execution were identified. 4. Sanitization: The skill does not perform sanitization of the text content received from the API before it is presented to the agent.
Audit Metadata