valuation-pricing-framework
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external financial data and user-provided information, which creates an inherent surface for indirect prompt injection if the input sources are compromised.
- Ingestion points: User-supplied stock names, financial records, and growth expectations as defined in SKILL.md.
- Boundary markers: Absent; the system prompt lacks specific delimiters or warnings to ignore instructions that might be embedded within the ingested financial data.
- Capability inventory: The skill is designed to use the
wind.financial.datatool and generate textual reports. No evidence of file system modification, shell command execution, or unauthorized network operations was found. - Sanitization: No explicit data sanitization or validation logic is present in the skill instructions.
- [SAFE]: The skill does not contain any prompt injection, obfuscation, persistence mechanisms, or hardcoded credentials. The instructions are consistent with the stated purpose of financial analysis and valuation.
Audit Metadata