vike-polymarket-smart-money
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard analytical extension that uses vendor-specific tools (vike-data) to fetch prediction market data. No evidence of obfuscation, data exfiltration, or unauthorized command execution was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Polymarket API, including market titles, slugs, and questions. While this data is untrusted, the overall risk is minimal because the skill's environment is restricted to data retrieval and formatting, without access to high-privilege capabilities.
- Ingestion points: External market data (titles, questions) retrieved via 'vike-data' (SKILL.md).
- Boundary markers: The provided output templates do not use specific delimiters or markers to isolate the third-party data.
- Capability inventory: The skill uses Bash to execute parallel calls to the 'vike-data' utility. No file-system write operations or non-whitelisted network requests are present.
- Sanitization: The instructions do not specify any validation or sanitization routines for the strings returned by the API.
Audit Metadata