build-model
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves financial data from the developer's official domain (daloopa.com) and performs web searches to collect market metrics and peer comparisons. These are standard operations for the skill's stated purpose of financial modeling.
- [COMMAND_EXECUTION]: The agent is instructed to use Python libraries such as openpyxl or internal spreadsheet tools to generate the multi-tab .xlsx workbook. This is a legitimate use of computational tools for document creation.
- [DATA_EXFILTRATION]: Generated reports are saved to the local reports/ directory. This constitutes local file writing rather than unauthorized data transmission to external parties.
- [PROMPT_INJECTION]: The skill processes external data from web searches and the Daloopa platform, creating an indirect prompt injection surface.
- Ingestion points: Web search results and Daloopa API data.
- Boundary markers: Not explicitly defined.
- Capability inventory: Python execution (openpyxl) and local file system writes.
- Sanitization: Not specified. The structured nature of the financial data extraction mitigates high-risk exploitation.
Audit Metadata