npx-ownership-panel

Warn

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: Several scripts use dynamic loading and execution. scripts/npx_linking/matching.py uses exec and compile to evaluate functions from other local scripts to ensure logic parity. scripts/dq_panel.py uses importlib.util to dynamically load and execute the ownership_dq.py module from variable paths.
  • [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains a shell command executed via the ! syntax at load time. This command attempts to locate and run a table-of-contents generation utility from a specific plugin directory.
  • [COMMAND_EXECUTION]: The orchestrator script scripts/npx_linking/pipeline.py uses subprocess.run to execute multiple Python scripts within the skill's directory.
  • [EXTERNAL_DOWNLOADS]: scripts/npx_linking/download_sec_series_class.py downloads data files directly from the official SEC.gov domain.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Ingests external fund names from the WRDS database and SEC filings (scripts pull_npx_funds.py and download_sec_series_class.py).
  • Boundary markers: External fund names are interpolated directly into the LLM judge prompt in scripts/npx_linking/judge_matches.py without delimiters.
  • Capability inventory: The LLM output adjudicates matches, which determines the composition of the final linking dataset used in the pipeline.
  • Sanitization: External names are normalized for matching but not sanitized for potential instruction markers before being sent to the LLM.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 5, 2026, 10:36 AM