position-size-calculator
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market data (quotes, chart data, and sentiment scores) from the vendor's official API at
app.sentisense.ai. These operations are limited to read-only GET requests. - [COMMAND_EXECUTION]: A local Node.js script (
scripts/prepare_data.mjs) is provided to automate data fetching and report generation. The script has zero external dependencies and performs validation on ticker symbols before processing. - [DATA_EXPOSURE]: The skill uses a
SENTISENSE_API_KEYenvironment variable for API authentication. It does not attempt to access unrelated sensitive files or exfiltrate system credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes external market data but includes robust mitigation against injection. The data binding process in
scripts/prepare_data.mjsandscripts/template.htmlspecifically escapes characters (e.g., replacing<with\u003c) to prevent malicious script injection into the generated HTML artifact. - [OBFUSCATION]: No obfuscation or hidden logic was detected. The code uses standard Node.js APIs and clear instructional markdown.
Audit Metadata