toobit-cex-market
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill defines a dependency on the
toobit-trade-clipackage, which is installed from the npm registry to provide the necessary command-line interface. - [COMMAND_EXECUTION]: The skill facilitates market data queries through the
toobitCLI. The instructions strictly limit the scope to read-only public data commands (e.g.,ticker,depth,klines) and explicitly prohibit use for account-modifying operations. - [INDIRECT_PROMPT_INJECTION]: The agent processes data retrieved from external exchange APIs, creating a potential surface for indirect injection if the API source were compromised.
- Ingestion points: Data is ingested via the standard output of the
toobit marketCLI commands as documented inSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content in the API responses.
- Capability inventory: The skill is permitted to execute
toobitshell commands as defined in the installation metadata. - Sanitization: There is no explicit mention of sanitization or validation of the market data strings before they are presented to the agent context.
Audit Metadata