backsolve-miner-vs-metal-ratio-with-fundamentals

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches price data and financial reports from external sources, including Yahoo Finance (yfinance), SEC EDGAR (data.sec.gov), and SEDAR+ (sedarplus.ca). These are well-known financial and regulatory services.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from corporate financial filings (MD&A text).
  • Ingestion points: Financial reports are fetched via the SEC XBRL API and scraped from SEDAR+ as described in workflows/data-fetch.md.
  • Boundary markers: The skill does not explicitly define delimiters for the ingested report content before placing it into the agent context.
  • Capability inventory: The skill has network access capabilities via httpx and selenium, and file writing capabilities for caching data in ./cache and outputting results.
  • Sanitization: The skill uses Regular Expressions (Regex) to extract specific financial metrics (AISC) from the text, which provides a degree of filtering against arbitrary instruction execution.
  • [REMOTE_CODE_EXECUTION]: The skill relies on several external Python packages listed in manifest.json, such as yfinance, selenium, and webdriver-manager. These are standard libraries for financial analysis and web automation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 10:32 PM