analyze-gas-fertilizer-contract-shock
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/fetch_te_data.pyscript executes the Google Chrome browser as a subprocess with remote debugging enabled (--remote-debugging-port=9222) and a custom user data directory to automate data collection. - [DYNAMIC_EXECUTION]: The skill uses the Chrome DevTools Protocol (CDP) via the
websocket-clientlibrary to evaluate and run JavaScript code within the automated browser instance to extract data from Highcharts objects on the TradingEconomics website. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external market data from public sources. It lacks explicit sanitization layers or boundary markers to prevent the agent from potentially interpreting malicious instructions if they were embedded within the scraped content or generated CSV files.
- [EXTERNAL_DOWNLOADS]: The skill fetches financial and commodity data from several external services including TradingEconomics, the Federal Reserve Economic Data (FRED) service, and the World Bank Pink Sheet data.
Audit Metadata