traderspy-smart-money
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from the TraderSpy API, which constitutes a potential attack surface for indirect instructions.
- Ingestion points: Data enters the agent's context through tools like get_positions, get_top_traders, and get_trader_profile (SKILL.md).
- Boundary markers: No specific delimiters or boundary markers are instructed for the data returned by the tools.
- Capability inventory: The skill is limited to read-only API calls; it lacks tools for file system modification, command execution, or outgoing network requests beyond the configured MCP server (SKILL.md).
- Sanitization: There are no instructions for sanitizing or escaping the data fetched from the remote exchange sources.
Audit Metadata