sec-edgar-pipeline

Warn

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The workflow utilizes edgar-analyzer generate-code to produce scripts at runtime based on patterns identified in project examples, which are then executed via edgar-analyzer run-extraction to perform data processing.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted external data from SEC EDGAR filings (e.g., DEF 14A HTML). While the process is structured, it represents an attack surface where adversarial content in a filing could attempt to influence the extraction logic or agent behavior.
  • Ingestion points: SEC EDGAR filing data (HTML/Text) fetched from public SEC servers.
  • Boundary markers: Not explicitly defined in the high-level documentation; the tool uses specialized adapters ('SCTAdapter') for parsing.
  • Capability inventory: Network operations to fetch filings, file system writes for reports (CSV/JSON), and execution of generated Python scripts.
  • Sanitization: Not specified; the skill relies on the parsing logic of the adapters to isolate relevant data.
  • [COMMAND_EXECUTION]: The skill relies on the edgar-analyzer CLI tool and several documented Python scripts (fetch_apple_def14a.py, create_csv_reports.py) to manage the extraction and reporting lifecycle.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 16, 2026, 12:53 PM
Security Audit — agent-trust-hub — sec-edgar-pipeline