monitor-etf-holdings-drawdown-risk
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches market data and ETF holding information from well-known financial platforms including Yahoo Finance, MacroMicro, and official ETF provider websites (iShares, Sprott, SPDR).
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
webdriver-managerpackage to automatically download and maintain thechromedriverbinary necessary for Selenium-based web scraping. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection as it ingests data from external websites (MacroMicro, iShares) which could theoretically contain malicious instructions. However, the risk is minimized as the ingested data is primarily numerical and is processed through quantitative analysis tools rather than being directly interpreted as instructions.
- Ingestion points:
scripts/fetch_etf_holdings.py(MacroMicro and ETF official websites). - Boundary markers: No explicit LLM boundary markers or "ignore instructions" prompts are used for the scraped content.
- Capability inventory: The skill possesses the ability to write local JSON/CSV files and execute visualization scripts.
- Sanitization: The skill uses
BeautifulSoupfor HTML parsing andpandasfor numerical data conversion, which provides structural validation of the incoming data.
Audit Metadata