expected-move-visualizer

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches financial metrics, including implied volatility, price quotes, and earnings history, from the vendor's API at app.sentisense.ai. These requests are authenticated using a user-provided API key.
  • [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (scripts/prepare_data.mjs) to aggregate data from the API and format it for the visualization template. This script has zero external dependencies and uses the standard Node.js fetch API.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents an ingestion surface as it processes data from an external API and user-supplied ticker symbols to generate HTML artifacts.
  • Ingestion points: Data enters the context via the app.sentisense.ai API endpoints processed in scripts/prepare_data.mjs.
  • Boundary markers: The instructions direct the agent to bind data into specific JSON blocks (/*__SENTISENSE_DATA__*/) within the HTML template to maintain structure.
  • Capability inventory: The skill performs local file writes to save the generated HTML visualizer and executes a local data-gathering script.
  • Sanitization: The skill implements sanitization at multiple levels, including encodeURIComponent for API parameters in the data script and a dedicated esc() function in the HTML template to escape entities before rendering strings into the chart.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 04:26 AM
Security Audit — agent-trust-hub — expected-move-visualizer