brief-company-financials
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows established patterns for automated research and data recording. Its activities are limited to reading configuration files, searching the web for public financial disclosures (such as SEC filings and press releases), and writing the findings to a structured markdown file.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests untrusted data from the web via WebSearch and WebFetch to populate a research brief. While the risk is mitigated by the instruction to produce a "numbers-only" brief, the following analysis applies:
- Ingestion points: External websites accessed during the numeric sourcing step (SKILL.md).
- Boundary markers: Absent; the skill does not explicitly provide instructions to the agent to disregard commands or instructions embedded within the fetched web content.
- Capability inventory: Write access to the local filesystem and limited Bash utility (mkdir, test) for directory management (SKILL.md).
- Sanitization: Absent; the skill focuses on data extraction and does not define specific validation or sanitization routines for the retrieved text strings.
Audit Metadata