trader-pelosi
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial disclosure indices and transaction reports (PDFs) from the official government domain
disclosures-clerk.house.gov. These are well-known public records used for the primary purpose of the skill. - [COMMAND_EXECUTION]: In
ptr.py, the script usessubprocess.runto call the system utilitypdftotext(from the poppler suite) for converting downloaded PDFs to plain text. The command is well-formed, uses static arguments, and handles PDF paths derived from the official index. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external PDF documents. While this creates a theoretical surface for indirect prompt injection, the risk is minimized by the authoritative nature of the government source and the use of specific regex patterns for parsing the content.
Audit Metadata