track-equity-cumulative-return
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes historical price data from an external source (Yahoo Finance), which represents a potential surface for indirect prompt injection if the external data source were compromised.
- Ingestion points:
scripts/fetch_price_data.pyfetches market data using theyfinancelibrary. - Boundary markers: No explicit delimiters or instructions are used to distinguish external API data from system instructions within the processing pipeline.
- Capability inventory: The skill has the ability to write JSON results (
scripts/cumulative_return_analyzer.py), generate and save PNG visualization charts (scripts/visualize_cumulative.py), and maintain a local Parquet cache (scripts/fetch_price_data.py). - Sanitization: Tickers, years, and indices are strictly validated in
scripts/validators.py. The price data itself is checked for basic quality (NaN percentage, non-positive values) inscripts/fetch_price_data.pybefore calculation.
Audit Metadata