analyze-move-risk-gauges-leadlag
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial time-series data from well-known and reputable services, including the Federal Reserve Economic Data (FRED) for ICE BofA corporate indices and Yahoo Finance for VIX volatility data.
- [COMMAND_EXECUTION]: The documentation provides explicit instructions for the user to execute shell commands to start a Google Chrome instance in debugging mode and to run the analysis scripts. These commands use a dedicated user profile to isolate the debugging session from the user's primary browser data.
- [DYNAMIC_EXECUTION]: The
fetch_data.pyscript uses thewebsocket-clientlibrary to interface with the local Chrome instance via the DevTools Protocol. It executes a hardcoded JavaScript snippet (EXTRACT_HIGHCHARTS_JS) within the browser context to programmatically extract numerical data from Highcharts objects. This is a common and legitimate pattern for scraping financial data from interactive dashboards. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from web-based financial sources to generate analysis reports, which constitutes an indirect prompt injection surface. However, the ingested data is primarily numerical, and the scripts apply sanitization by coercing inputs to numeric types and handling missing values before processing.
Audit Metadata