zeberg-salomon-rotator
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses well-known and reputable data sources for its primary purpose. It fetches economic indicators from the Federal Reserve Economic Data (FRED) service and asset price data from Yahoo Finance via the
yfinancelibrary. These are established services for financial analysis. - [SAFE]: No hardcoded credentials or sensitive data exposure were identified. The skill explicitly states that it uses public data sources that do not require API keys, and no evidence of credential harvesting was found in the scripts.
- [SAFE]: No obfuscation, dynamic code execution (e.g.,
eval,exec), or privilege escalation attempts were detected. The Python scripts use standard data processing workflows withpandasandnumpy. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for external data that could theoretically be used for indirect prompt injection, though the risk is mitigated by the data's nature.
- Ingestion points: Data is fetched from external CSV endpoints at
fred.stlouisfed.organd Yahoo Finance inscripts/fetch_data.py. - Boundary markers: The skill treats ingested data as purely numerical time-series. It does not attempt to interpret text from these sources as instructions.
- Capability inventory: The skill provides Python scripts (
rotator.py,fetch_data.py,visualize.py) for local execution. It has the capability to write JSON and image files to a localoutput/directory as requested by the user. - Sanitization: In
scripts/fetch_data.py, data is sanitized usingpd.to_numeric(..., errors="coerce"), which ensures that only numerical data is passed to the analysis engine, effectively neutralizing non-numeric text payloads.
Audit Metadata