options-payoff-calculator
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market data, including implied volatility and pricing information, from the vendor's API at app.sentisense.ai over HTTPS. These operations are restricted to the build phase and are necessary for the skill's primary function.
- [COMMAND_EXECUTION]: The skill includes a local Node.js script (scripts/prepare_data.mjs) used to fetch API data and bind it to an HTML template. This script has zero external dependencies and performs only authorized file system and network operations.
- [REMOTE_CODE_EXECUTION]: Skill documentation mentions using the vendor's CLI tool via npx -y sentisense@0.52.0 for data fetching. This uses a version-pinned package from a well-known registry (npm), which is a standard and acceptable developer practice.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted market data from API endpoints and interpolates it into an HTML template for rendering.
- Ingestion points: API responses for options summaries, quotes, and earnings calendars processed in scripts/prepare_data.mjs.
- Boundary markers: Data is encapsulated within tags in the template.
- Capability inventory: The skill creates a local HTML artifact but does not perform subsequent writes or network operations based on the data content.
- Sanitization: The binding script explicitly escapes "<" characters in JSON, and the HTML template uses a robust escaping function for all dynamic content to prevent cross-site scripting (XSS) or injection.
Audit Metadata