smart-money-tracker
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of established Python libraries such as
requests,pydantic, andpyyamlfrom the standard package registry. It performs legitimate network requests to SEC EDGAR (sec.gov), the House Clerk (house.gov), and InsiderFinance (insiderfinance.io) to gather financial trading and disclosure data as part of its core functionality. - [PROMPT_INJECTION]: The skill processes untrusted data from external financial sources, which constitutes an indirect prompt injection surface.
- Ingestion points: financial trade data is retrieved from SEC EDGAR, House Clerk, and InsiderFinance APIs (files
sec13f.py,congress.py,house_reps.py). - Boundary markers: Absent in the data processing flow.
- Capability inventory: The skill uses network retrieval (
requests) and file system access to generate markdown reports. - Sanitization: External content is normalized into structured Python dictionaries and filtered for specific fields before being interpolated into the generated markdown reports.
Audit Metadata