scanning-market-movers
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches real-time cryptocurrency market data from CoinGecko's official API (api.coingecko.com). This is a well-known service providing the data required for the skill's primary analysis functions.\n- [COMMAND_EXECUTION]: Provides Python scripts (scanner.py, analyzer.py) for market scanning. These scripts include logic for dynamic path manipulation to import modules from a required sibling plugin (market-price-tracker), representing standard vendor-specific dependency integration.\n- [DATA_EXFILTRATION]: Includes the ability to export processed analysis results to local JSON or CSV files at user-defined paths via the --output parameter in the scanner script.\n- [PROMPT_INJECTION]: The skill processes external data (asset names and symbols) from the CoinGecko API, creating a surface for indirect prompt injection. Boundary markers are absent, and while data is parsed as JSON, there is no additional sanitization of the content before it is presented to the agent. The skill possesses file-writing capabilities which could be targeted by such an injection.
Audit Metadata