you-finance

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: No security issues were detected. The skill follows established best practices for AI agent safety and configuration management.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external financial data, creating a potential attack surface. This is addressed by explicit instructions to treat search results as evidence and not as instructions. * Ingestion points: Financial data and market trends retrieved via the you-finance MCP tool. * Boundary markers: Present; includes specific directives in SKILL.md to treat external results as untrusted. * Capability inventory: No dangerous local capabilities such as file system writing or arbitrary command execution are present in the skill scripts. * Sanitization: The agent is instructed to cite sources and flag uncertainty in data.
  • [EXTERNAL_DOWNLOADS]: The skill refers to the official Coinbase Payments MCP repository for optional payment features. This is a reference to a well-known service for standard functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 03:57 AM