trader-pelosi

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches financial disclosure indices and transaction reports (PDFs) from the official government domain disclosures-clerk.house.gov. These are well-known public records used for the primary purpose of the skill.
  • [COMMAND_EXECUTION]: In ptr.py, the script uses subprocess.run to call the system utility pdftotext (from the poppler suite) for converting downloaded PDFs to plain text. The command is well-formed, uses static arguments, and handles PDF paths derived from the official index.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external PDF documents. While this creates a theoretical surface for indirect prompt injection, the risk is minimized by the authoritative nature of the government source and the use of specific regex patterns for parsing the content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 12:13 PM