sec-edgar-pipeline
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The workflow utilizes
edgar-analyzer generate-codeto produce scripts at runtime based on patterns identified in project examples, which are then executed viaedgar-analyzer run-extractionto perform data processing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data from SEC EDGAR filings (e.g., DEF 14A HTML). While the process is structured, it represents an attack surface where adversarial content in a filing could attempt to influence the extraction logic or agent behavior.
- Ingestion points: SEC EDGAR filing data (HTML/Text) fetched from public SEC servers.
- Boundary markers: Not explicitly defined in the high-level documentation; the tool uses specialized adapters ('SCTAdapter') for parsing.
- Capability inventory: Network operations to fetch filings, file system writes for reports (CSV/JSON), and execution of generated Python scripts.
- Sanitization: Not specified; the skill relies on the parsing logic of the adapters to isolate relevant data.
- [COMMAND_EXECUTION]: The skill relies on the
edgar-analyzerCLI tool and several documented Python scripts (fetch_apple_def14a.py,create_csv_reports.py) to manage the extraction and reporting lifecycle.
Audit Metadata