financial-reports-scraper

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches financial data, XBRL facts, and filing documents from official sources including the US Securities and Exchange Commission (sec.gov) and BlackRock's iShares platform (ishares.com).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites which presents a potential surface for indirect prompt injection if downstream agents consume the extracted text without validation.
  • Ingestion points: www.sec.gov, data.sec.gov, and ishares.com (HTML, JSON, and CSV data).
  • Boundary markers: No specific delimiters or "ignore instructions" markers are applied to the extracted text data in the output CSV or manifest.
  • Capability inventory: Performs network reads via the requests library and writes results to the local filesystem using pandas and standard file operations.
  • Sanitization: Implements basic sanitization in evidence.py by using BeautifulSoup to decompose script, style, noscript, and ix:hidden tags from SEC filings before text extraction.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 03:48 PM