primary-logic-external-api

Pass

Audited by Gen Agent Trust Hub on Feb 26, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes external investment data which constitutes an indirect prompt injection surface.
  • Ingestion points: Data is ingested from the Primary Logic API via multiple endpoints including /v1/content and /v1/tickers/{ticker}/content as described in SKILL.md and api-recipes.md.
  • Boundary markers: The skill does not define specific delimiters or explicit instructions to ignore embedded commands within the API-returned summaries or snippets.
  • Capability inventory: The skill's primary capability is information retrieval and formatting. It has network access to the specified vendor API but lacks high-risk capabilities like writing to the filesystem or executing arbitrary shell commands.
  • Sanitization: No explicit sanitization of retrieved API content is mentioned in the logic.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with https://primarylogic--pulse-backend-external-api-app.modal.run for data retrieval. This domain is a vendor-owned resource hosted on Modal, matching the author 'primary-logic'. References and connectivity tests in the documentation are documented as safe vendor communications.
  • [COMMAND_EXECUTION]: Documentation files such as api-recipes.md and validation.md contain shell script examples including curl, jq, and skills-ref. These are provided as instructional recipes for developers or manual verification and are not part of the agent's autonomous runtime execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 26, 2026, 07:11 PM