company-valuation
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill auto-installs standard Python libraries including
yfinance,numpy, andpandas. These are well-known packages from the official Python Package Index used for financial modeling and data analysis.\n- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection inSKILL.mdto run shell commands at load time. These commands are used to verify the runtime environment and fetch the current 10-year Treasury yield from Yahoo Finance to serve as a risk-free rate for its valuation models.\n- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes financial statements and metadata (such as company descriptions) retrieved from Yahoo Finance. Untrusted content in these fields could theoretically be used to influence the agent's logic during report generation.\n - Ingestion points: External data enters the context via the
yfinancelibrary in Step 3 ofSKILL.md.\n - Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potential commands embedded in the financial data.\n
- Capability inventory: The skill environment supports Python script execution, shell command execution via the platform's dynamic context feature, and package installation via
pip.\n - Sanitization: The skill does not implement specific sanitization or validation routines for the text-based metadata it retrieves from the external data provider.
Audit Metadata