toobit-cex-market

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill defines a dependency on the toobit-trade-cli package, which is installed from the npm registry to provide the necessary command-line interface.
  • [COMMAND_EXECUTION]: The skill facilitates market data queries through the toobit CLI. The instructions strictly limit the scope to read-only public data commands (e.g., ticker, depth, klines) and explicitly prohibit use for account-modifying operations.
  • [INDIRECT_PROMPT_INJECTION]: The agent processes data retrieved from external exchange APIs, creating a potential surface for indirect injection if the API source were compromised.
  • Ingestion points: Data is ingested via the standard output of the toobit market CLI commands as documented in SKILL.md.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content in the API responses.
  • Capability inventory: The skill is permitted to execute toobit shell commands as defined in the installation metadata.
  • Sanitization: There is no explicit mention of sanitization or validation of the market data strings before they are presented to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:36 PM