margin-management
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the system
datecommand to generate formatted timestamps for recording entries in the margin dashboard. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes untrusted data from external balance files.
- Ingestion points: Financial data is ingested from
notebooks/updates/Balances_for_Account_{account_id}.csvandfin-guru/data/user-profile.yaml. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the data processing flow.
- Capability inventory: The skill has the capability to write to external spreadsheets using the
mcp__gdrive__sheetstool. - Sanitization: The skill extracts specific numeric fields but lacks explicit sanitization or validation of the input strings before processing or writing to the spreadsheet.
- [SAFE]: The skill implements a manual safety checkpoint that halts the workflow and requests user confirmation if a margin draw exceeds $5,000, providing protection against unintended large financial transactions.
Audit Metadata