analyze-jgb-insurer-superlong-flow
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches monthly bond transaction Excel files from the official Japan Securities Dealers Association (JSDA) website. The
scripts/jsda_flow_analyzer.pyutility explicitly bypasses SSL certificate verification (ssl.CERT_NONE) during data downloads. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources which could potentially contain adversarial natural language instructions.
- Ingestion points: Monthly Excel files downloaded from the
jsda.or.jpdomain and parsed inscripts/jsda_flow_analyzer.pyandscripts/fetch_jsda_data.py. - Boundary markers: No delimiters or warnings are used to differentiate data from instructions during parsing.
- Capability inventory: The skill has the capability to perform network fetches, write to the local file system (including a path multiple levels above the skill directory), and generate structured analysis reports.
- Sanitization: No sanitization of Excel cell content is performed before presenting the data to the agent.
- [COMMAND_EXECUTION]: Instructions in
SKILL.mdprovide specific shell commands for the agent to install Python dependencies and execute analysis scripts.
Audit Metadata