progressive-investment-research
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a structured workflow for research that incorporates several security best practices for AI agents. Specifically, it addresses the risk of indirect prompt injection (Category 8) by requiring that all external data be converted into 'Evidence Objects' (Source Cards, Claim Rows, etc.) and reviewed as a 'Model Patch Candidate' before affecting the core research model. This creates a clear boundary between untrusted external data and the agent's internal reasoning.
- [COMMAND_EXECUTION]: While the skill instructions discuss the creation and execution of Python scripts (
scripts/calc_*.py) for financial modeling, this is described as a thin calculation layer for the skill's primary purpose. The provided management scripts (scaffold_dossier.py,validate_dossier.py, etc.) use standard libraries for file and text processing and do not perform arbitrary command execution or subprocess spawning. - [EXTERNAL_DOWNLOADS]: The skill mentions external tools like AnySearch and Tavily, and data sources like SEC filings and official company IR pages. These are well-known services or part of the author's development ecosystem used for legitimate research purposes. No suspicious or unverified remote code execution patterns (like
curl | bash) were detected.
Audit Metadata