earnings-prep
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from web searches and financial transcripts, creating a surface for indirect prompt injection where malicious instructions embedded in web content could influence the agent's behavior.
- Ingestion points: Data enters the context via
WebSearchresults andsearch_documentscalls for filings and transcripts across multiple sections. - Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or specific separators) to distinguish external data from the skill's instructions.
- Capability inventory: The skill has the ability to search the web, access financial databases via the
daloopa.comAPI, and write HTML reports to the local file system. - Sanitization: No specific sanitization or filtering logic is provided for the external content before it is processed or included in the final report.
- [DATA_EXFILTRATION]: The skill interacts with
daloopa.com, which is the official domain of the skill's author. This represents normal vendor functionality for retrieving fundamental financial data and is not considered a security risk.
Audit Metadata