company-valuation

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes shell execution placeholders to perform environment readiness checks and retrieve a live 10-year Treasury rate from market data providers when the skill is initialized.\n
  • Evidence: Execution of python3 -c commands inside SKILL.md for YFIN_OK status and RF_10Y fetching.\n- [EXTERNAL_DOWNLOADS]: The skill specifies the installation of standard data science and financial libraries from public registries if they are not already available in the runtime environment.\n
  • Evidence: Instruction to run python3 -m pip install for yfinance, numpy, and pandas in SKILL.md.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute multiple Python code blocks to process financial statements and calculate valuation metrics like WACC and DCF.\n
  • Evidence: Numerous Python code snippets in SKILL.md for data pulling (Step 3), DCF calculation (Step 4), and relative valuation (Step 5).\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided ticker symbols which are used as inputs for external data fetching and subsequent calculations, creating a potential surface for indirect injection if data sources are compromised.\n
  • Ingestion points: TICKER variable in Step 3 of SKILL.md.\n
  • Boundary markers: None present in the prompt templates.\n
  • Capability inventory: Shell execution (python3) and network access (yfinance).\n
  • Sanitization: No explicit validation of the ticker input symbol string before it is passed to the Ticker object.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 10:31 PM