finance-report
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill integrates internal project CLI tools by invoking them via subprocess calls. Evidence is located in
tools/ChartKit.pywithin therun_cli_toolfunction, which executes modules such assrc.utils.momentum_cliandsrc.analysis.risk_metrics_cli. These calls are restricted to internal project paths and represent standard tool-chaining behavior. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external search providers like Perplexity and Exa to populate its research sections. As documented in
workflows/FullResearchWorkflow.md, this data is used for catalysts and risk assessment. While this presents an ingestion surface for untrusted external content, it is an essential feature of the research-oriented skill and follows standard agentic workflows. - [EXTERNAL_DOWNLOADS]: The skill references standard third-party dependencies required for its primary functions. These include
matplotlibandnumpyfor data visualization intools/ChartKit.py, andreportlabfor PDF generation intools/ReportGenerator.py. These are well-known, reputable libraries within the Python ecosystem.
Audit Metadata