financial-reports-scraper
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial data, XBRL facts, and filing documents from official sources including the US Securities and Exchange Commission (sec.gov) and BlackRock's iShares platform (ishares.com).
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites which presents a potential surface for indirect prompt injection if downstream agents consume the extracted text without validation.
- Ingestion points:
www.sec.gov,data.sec.gov, andishares.com(HTML, JSON, and CSV data). - Boundary markers: No specific delimiters or "ignore instructions" markers are applied to the extracted text data in the output CSV or manifest.
- Capability inventory: Performs network reads via the
requestslibrary and writes results to the local filesystem usingpandasand standard file operations. - Sanitization: Implements basic sanitization in
evidence.pyby using BeautifulSoup to decomposescript,style,noscript, andix:hiddentags from SEC filings before text extraction.
Audit Metadata