market-top-detector
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market breadth data from a public CSV file hosted on the author's GitHub Pages domain (tradermonty.github.io). This external reference is required for the quantitative scoring system and is used solely for data retrieval.
- [COMMAND_EXECUTION]: The skill executes Python scripts to perform calculations and generate risk reports. The main orchestrator and its modules utilize the requests library for legitimate network communication with the Financial Modeling Prep (FMP) API and the author's data repository.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external CSV and API sources. The risk of indirect prompt injection is mitigated by the script's use of strict type-casting; specifically, the breadth_csv_client.py and market_top_detector.py scripts convert incoming data strings to float, integer, or date types before including them in generated Markdown reports, which prevents the interpretation of malicious natural language instructions.
- [SAFE]: The skill follows security best practices for secret management by instructing users to provide API keys via environment variables or command-line arguments rather than hardcoding them. Additionally, its file operations are limited to writing JSON and Markdown reports to a designated output directory.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata