both-stock-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates a multi-step pipeline by instructing the agent to execute local Python scripts (e.g.,
skills/har-to-api/scripts/fetch.py,skills/pipeline/business-drivers/scripts/sensitivity.py,skills/stock-grill/scripts/read_report.py). These commands are task-aligned and restricted to internal skill directories. - [DYNAMIC_EXECUTION]: The skill generates a filing-grade HTML research document using a
bashheredoc. This is a standard reporting mechanism and does not involve the execution of untrusted code. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (ticker facts and market data) via the
har-to-apiutility. While this represents a data ingestion surface, the risk is mitigated by the structured nature of financial metrics and the use of dedicated internal scripts to process the data. - [SAFE]: The workflow follows financial analysis best practices (the Damodaran framework), confirms market parameters to ensure calculation accuracy, and includes explicit disclaimers regarding financial advice.
Audit Metadata