company-valuation
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell execution placeholders to perform environment readiness checks and retrieve a live 10-year Treasury rate from market data providers when the skill is initialized.\n
- Evidence: Execution of python3 -c commands inside SKILL.md for YFIN_OK status and RF_10Y fetching.\n- [EXTERNAL_DOWNLOADS]: The skill specifies the installation of standard data science and financial libraries from public registries if they are not already available in the runtime environment.\n
- Evidence: Instruction to run python3 -m pip install for yfinance, numpy, and pandas in SKILL.md.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute multiple Python code blocks to process financial statements and calculate valuation metrics like WACC and DCF.\n
- Evidence: Numerous Python code snippets in SKILL.md for data pulling (Step 3), DCF calculation (Step 4), and relative valuation (Step 5).\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided ticker symbols which are used as inputs for external data fetching and subsequent calculations, creating a potential surface for indirect injection if data sources are compromised.\n
- Ingestion points: TICKER variable in Step 3 of SKILL.md.\n
- Boundary markers: None present in the prompt templates.\n
- Capability inventory: Shell execution (python3) and network access (yfinance).\n
- Sanitization: No explicit validation of the ticker input symbol string before it is passed to the Ticker object.
Audit Metadata