data912-market-data
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The skill makes network requests to https://data912.com. This domain is not in the trusted whitelist but is the legitimate endpoint for the skill's stated purpose.
- [COMMAND_EXECUTION] (LOW): The skill uses curl and jq for data processing. There is a potential risk of command injection if user-provided ticker symbols are not properly sanitized before being interpolated into shell commands.
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill processes untrusted data from an external API, creating a surface for indirect prompt injection. Ingestion points: Data is ingested via API calls to https://data912.com as described in SKILL.md. Boundary markers: None identified; the skill lacks explicit instructions to ignore instructions embedded in the API responses. Capability inventory: Uses curl and jq to execute network and parsing tasks. Sanitization: No specific sanitization or validation of the input {ticker} or the API output is described.
Audit Metadata