calculating-crypto-taxes
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from exchange CSV exports via the
scripts/transaction_parser.pyscript. While this data is untrusted, it is processed as structured financial values rather than instructions. - Ingestion points: The
scripts/transaction_parser.pyscript reads and parses user-provided CSV files from various cryptocurrency exchanges. - Boundary markers: The skill relies on structured CSV parsing; data is delimited by standard CSV separators and mapped to specific fields (date, quantity, price).
- Capability inventory: The skill uses the
Writetool to save reports and theBashtool to execute the calculation logic inscripts/tax_calculator.py. - Sanitization: The tool implements strict type validation, converting input strings into Python
Decimalanddatetimeobjects, which effectively prevents input data from being interpreted as instructions. - [EXTERNAL_DOWNLOADS]: The documentation (
ARD.md) and configuration (config/settings.yaml) indicate support for the CoinGecko API to fetch historical price data. CoinGecko is a well-known and established service for cryptocurrency market data.
Audit Metadata