investment-data
Warn
Audited by Snyk on Mar 7, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's runtime includes scripts/download_data.py (and the update_data() method) which fetches public release artifacts via the GitHub API and downloads data from GitHub releases (and the docs/config also reference public sources like DoltHub, Tushare, Akshare, and Yahoo), so it clearly ingests untrusted public third-party data as part of its workflow.
Audit Metadata