breadth-chart-analyst
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from
https://tradermonty.github.io/market-breadth-analysis/market_breadth_data.csv, which is flagged as a malicious URL by automated scanners (URLite). - [REMOTE_CODE_EXECUTION]: The core data-processing script,
scripts/fetch_breadth_csv.py, is identified as malware (FileRepMalware) by reputation scanners. The skill instructions mandate the execution of this script by the agent. - [COMMAND_EXECUTION]: The skill requires the agent to run local Python scripts (
fetch_breadth_csv.pyandextract_chart_right_edge.py) to process market data and chart images. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its data ingestion pipeline.
- Ingestion points: Untrusted CSV data is fetched from external web sources via
fetch_breadth_csv.py. - Boundary markers: The instructions in
SKILL.mddo not include protective delimiters or warnings to ignore instructions that might be embedded in the external data. - Capability inventory: The agent has the ability to execute shell commands and write files, creating an escalation path if malicious instructions are ingested.
- Sanitization: While numerical values are converted to floats, string fields from the CSV (such as 'trend' or 'status') are not sanitized before being processed by the model.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata