expected-move-visualizer
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial metrics, including implied volatility, price quotes, and earnings history, from the vendor's API at
app.sentisense.ai. These requests are authenticated using a user-provided API key. - [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (
scripts/prepare_data.mjs) to aggregate data from the API and format it for the visualization template. This script has zero external dependencies and uses the standard Node.jsfetchAPI. - [INDIRECT_PROMPT_INJECTION]: The skill represents an ingestion surface as it processes data from an external API and user-supplied ticker symbols to generate HTML artifacts.
- Ingestion points: Data enters the context via the
app.sentisense.aiAPI endpoints processed inscripts/prepare_data.mjs. - Boundary markers: The instructions direct the agent to bind data into specific JSON blocks (
/*__SENTISENSE_DATA__*/) within the HTML template to maintain structure. - Capability inventory: The skill performs local file writes to save the generated HTML visualizer and executes a local data-gathering script.
- Sanitization: The skill implements sanitization at multiple levels, including
encodeURIComponentfor API parameters in the data script and a dedicatedesc()function in the HTML template to escape entities before rendering strings into the chart.
Audit Metadata