skills/jeremylongshore/claude-code-plugins-plus-skills/tracking-crypto-portfolio/Gen Agent Trust Hub
tracking-crypto-portfolio
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python scripts via the Bash tool to perform portfolio analysis and data aggregation. This is the primary intended function for calculating valuations.\n- [PROMPT_INJECTION]: Indirect Prompt Injection (Category 8): The skill ingests untrusted data from local JSON portfolio files, which presents a surface for instructions to be embedded in data fields.\n
- Ingestion points:
scripts/portfolio_loader.pyreads holdings and metadata from user-provided JSON files.\n - Boundary markers: Absent. Output generated by
scripts/formatters.pydoes not use delimiters to wrap processed data.\n - Capability inventory: The skill has access to
Bash(scoped),Read, andWritetools.\n - Sanitization: Absent. The implementation validates data types (e.g., converting quantities to floats) but does not filter or sanitize string content for potential injection patterns.
Audit Metadata