crypto-regime-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market cap, price history, and dominance metrics from
api.coingecko.com. It also retrieves perpetual funding rates from the Binance futures API atfapi.binance.com. These interactions target well-known financial data services. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs which could theoretically contain malicious instructions, although the current implementation focuses on numeric values and performs validation. The
idfield from the API is used to construct local file paths in the cache directory, which could lead to path traversal if the source provides malicious IDs. - Ingestion points: External data enters the skill via
DataClient.fetch_universe(CoinGecko) and Binance endpoints inscripts/data_client.py. - Boundary markers: The analysis results are structured into JSON and Markdown reports (
crypto_regime.jsonandcrypto_regime.md) for agent interpretation. - Capability inventory: The skill performs file writes to create reports and maintain a local cache in
scripts/data_client.py. - Sanitization: Extensive numeric validation is performed in
scripts/data_client.py(e.g.,_require_finite_number), but the skill lacks sanitization forcoin_idstrings used in file path construction inscripts/data_client.py.
Audit Metadata