a-stock-daily-report
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's behavior is consistent with its stated purpose of generating financial reports from public data sources. It uses built-in Node.js modules (http, https) and requires no external dependencies.
- [EXTERNAL_DOWNLOADS]: The script
scripts/a-stock-report.jsfetches market data fromhttp://push2.eastmoney.com/api/qt/clist/getandhttp://push2.eastmoney.com/api/qt/stock/get. These are well-known public endpoints for financial information provided by Eastmoney (东方财富网). - [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could theoretically contain malicious instructions if the source were compromised.
- Ingestion points:
scripts/a-stock-report.jsfetches data from Eastmoney APIs via thefetchBoardDataandfetchIndexDatafunctions. - Boundary markers: Absent; data is interpolated directly into Markdown table templates.
- Capability inventory: Network read (HTTP/HTTPS) and standard output (console.log). The skill does not possess file-write or arbitrary command execution capabilities.
- Sanitization: Absent; the script assumes the API returns valid numerical or string data for stock indices and sectors. However, the risk is mitigated by the use of a well-known financial service provider.
Audit Metadata