eastmoney-api

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user to execute local shell and Python scripts for installation, testing, and data retrieval, including scripts/install.sh, scripts/em.py, scripts/test.sh, and model training scripts.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes news, reports, and stock data from external sources (Eastmoney and Sina), which could potentially contain adversarial instructions designed to influence the agent's behavior.
  • Ingestion points: Data is ingested via the get_news_and_reports and get_market_news tools within the scripts/em.py script.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands were found in the provided documentation.
  • Capability inventory: The skill environment allows for local script execution and network requests to financial data providers.
  • Sanitization: The documentation does not describe any specific sanitization or filtering of the external text content before it enters the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 10:41 AM