investment-strategy-check
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied content from a markdown file (investing.md) to interpret investment policies. This creates a surface for indirect prompt injection where malicious instructions could be embedded to manipulate the AI's assessment logic.\n
- Ingestion points: Reads content from user-provided investing.md files.\n
- Boundary markers: Includes specific instructions to treat document contents solely as evidence and not as new instructions for the assistant.\n
- Capability inventory: Uses MCP tools to read policies, check actions, and record decisions on a remote server.\n
- Sanitization: Relies on structured tool schemas and explicit user confirmation for state-changing operations.\n- [EXTERNAL_DOWNLOADS]: The skill connects to an MCP server at https://app.investboard.com/mcp to retrieve tool definitions and perform live account functions. This endpoint is a vendor-owned resource managed by the author.
Audit Metadata