bf-tech-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the yfinance library, creating a potential surface for indirect prompt injection if the financial data source were manipulated. However, the data is primarily numeric and processed via standard analytical tools.\n
- Ingestion points: The yf.Ticker.history method is used in references/indicators.md to pull weekly and daily market data.\n
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the data processing flow.\n
- Capability inventory: The skill utilizes Python code execution and local shell command execution to process data and calculate technical indicators.\n
- Sanitization: Data is managed using pandas operations such as dropna and rolling averages, which provide implicit structure and validation.\n- [COMMAND_EXECUTION]: The skill provides instructions to run a local script for data retrieval as a fallback mechanism.\n
- Evidence: The SKILL.md file contains a shell command block for executing python skills/har-to-api/scripts/fetch.py with ticker and date arguments.\n- [DYNAMIC_EXECUTION]: The skill relies on the agent executing provided Python logic for financial calculations and indicator calibration.\n
- Evidence: Detailed Python code for calculating ATR, RSI, Weinstein stages, and VCP patterns is included in references/indicators.md to be executed by the agent.
Audit Metadata