options-payoff
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection to execute a
python3subprocess that fetches market data from Yahoo Finance via theyfinancelibrary at skill load time. - [PROMPT_INJECTION]: The skill ingests untrusted data from user-provided strategy descriptions and broker screenshots, creating an indirect prompt injection surface. (1) Ingestion points: User text and image uploads (SKILL.md). (2) Boundary markers: Absent. (3) Capability inventory: Uses
visualize:show_widgetto render interactive components. (4) Sanitization: Not explicitly present in the extracted logic. - [REMOTE_CODE_EXECUTION]: The skill performs dynamic script generation by creating JavaScript code for interactive P&L charts based on user-supplied parameters.
Audit Metadata