market-heatmap
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/heatmap.pyto process data and generate HTML output. The script is transparent, uses only the Python standard library, and performs no dangerous system-level operations. - [EXTERNAL_DOWNLOADS]: The script performs a single HTTP GET request to
https://app.sentisense.ai/api/v1/trackers/market-heatmap. This is a vendor-owned domain used for the skill's primary function of fetching market data. - [DATA_EXFILTRATION]: While the skill requires an API key (
SENTISENSE_API_KEY) and makes a network call, the destination is the official vendor API. No local sensitive files (like SSH keys or AWS credentials) are accessed or transmitted. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the API which is then summarized for the agent. The script includes dedicated sanitization functions (
esc()andsafe()) to escape HTML special characters and prevent injection into the generated HTML file. The data processed consists of structured financial records (tickers, prices, market caps).
Audit Metadata