trade-signal
Warn
Audited by Snyk on Mar 10, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's script (scripts/search.sh) calls https://terminal-x.ai/api/lite-search and the SKILL.md explicitly documents that responses incorporate third-party news, analyst reports, earnings transcripts and SEC filings which the agent ingests and uses to generate actionable Buy/Sell/Hold recommendations, so untrusted public content can materially influence agent decisions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The scripts/search.sh runs at runtime and curls https://terminal-x.ai/api/lite-search?query=..., returning JSON fields like "agentAnswer" and "tradeSignal" that are injected into agent responses, so remote content directly controls the agent's output and is a required dependency.
Audit Metadata