finance-report

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill integrates internal project CLI tools by invoking them via subprocess calls. Evidence is located in tools/ChartKit.py within the run_cli_tool function, which executes modules such as src.utils.momentum_cli and src.analysis.risk_metrics_cli. These calls are restricted to internal project paths and represent standard tool-chaining behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search providers like Perplexity and Exa to populate its research sections. As documented in workflows/FullResearchWorkflow.md, this data is used for catalysts and risk assessment. While this presents an ingestion surface for untrusted external content, it is an essential feature of the research-oriented skill and follows standard agentic workflows.
  • [EXTERNAL_DOWNLOADS]: The skill references standard third-party dependencies required for its primary functions. These include matplotlib and numpy for data visualization in tools/ChartKit.py, and reportlab for PDF generation in tools/ReportGenerator.py. These are well-known, reputable libraries within the Python ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:41 PM