find-next-crypto-idea
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads platform configuration from the user's home directory (
~/.superstack/config.json) and sends system metadata (platform name, architecture, and skill usage) to an external URL usingcurl. Although the endpoint is retrieved from the configuration and the skill prompts for user consent, it establishes a functional path for data exfiltration. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the filesystem, including directory traversal (
../../../data/ideas/) to access datasets located several levels above the skill's root directory. - [EXTERNAL_DOWNLOADS]: The research playbook recommends the use of
npx bird.fast, which downloads and executes code from the NPM registry at runtime. This introduces a dependency on external, unpinned code. - [PERSISTENCE]: The skill modifies the user's platform configuration and creates a hidden marker file (
~/.superstack/.telemetry-prompted) to maintain state and telemetry preferences across different sessions. - [DYNAMIC_EXECUTION]: The workflow relies on external Python scripts (
scripts/live_research.pyandscripts/render_report.py) that are not provided in the skill source code, making their specific runtime behavior unverifiable. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted external sources such as X (Twitter), GitHub, and various web blogs to generate and rank startup ideas, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Research results from
scripts/live_research.py(X, GitHub, Web search) and the Helius blog. - Boundary markers: None; there are no instructions to the agent to treat external data as untrusted or to ignore embedded commands.
- Capability inventory: The skill has access to shell execution (
bash), network operations (curl), and script execution (python3). - Sanitization: The instructions do not define any sanitization, filtering, or validation logic for the external data before it is processed by the agent.
Audit Metadata