alterlab-edgartools
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to download regulatory filings and data from the SEC EDGAR system.- [COMMAND_EXECUTION]: It includes methods to launch a local web server for viewing documents (filing.serve) and to open URLs in the system's default web browser (filing.open).- [REMOTE_CODE_EXECUTION]: The MCP server configuration instructions utilize uvx to download and execute the edgartools-mcp package at runtime.- [PROMPT_INJECTION]: As the skill ingests external SEC filings and converts them to Markdown for processing, it exhibits an indirect prompt injection surface (Ingestion points: filings.md, xbrl.md). The capability inventory includes file-system writes (filing.save, filing.download) and local network serving (filing.serve), with no explicit boundary markers or sanitization protocols mentioned in the analyzed documentation.
Audit Metadata