investment-memo
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates as a structured template generator for financial documents. It follows established practices for financial reporting and does not attempt to access sensitive system files, execute unauthorized commands, or exfiltrate data.
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data (Due Diligence findings) which is then used to generate documents.
- Ingestion points: User-provided company background, market analysis, and management assessments mentioned in the 'How to Use Me' section (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters to isolate user-provided data from the agent's internal instructions.
- Capability inventory: The skill uses tools for document creation and conversion including
create_docx,fill_docx_template, anddocx_to_pdf(SKILL.md). - Sanitization: No explicit sanitization or filtering of user input is described in the prompt logic.
- This pattern is standard for document generation assistants and is considered a low-risk design attribute rather than a vulnerability.
Audit Metadata