pitch-agent
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes financial data and business descriptions retrieved from external, potentially untrusted sources like SEC filings and web search results.
- Ingestion points: Reads company business models and market positions from SEC 10-K/10-Q filings (SKILL.md, Step 2) and identifies recent transaction data through web searches (SKILL.md, Step 3).
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present to isolate the external data from the agent's core instructions.
- Capability inventory: The agent has the capability to generate and save Excel (.xlsx) and PowerPoint (.pptx) files, and it uses Python for mathematical modeling and charting.
- Sanitization: The skill does not describe any specific sanitization or validation mechanisms for the text data extracted from external filings.
- [EXTERNAL_DOWNLOADS]: The skill references several external APIs and libraries to perform its financial analysis and document generation tasks.
- APIs: Utilizes Tushare Pro (via MCP tools) for financial metrics, and exchangerate-api for currency conversion.
- Python Packages: The instructions mention the use of yfinance for US stock data, python-pptx for presentation creation, and matplotlib or plotly for generating valuation charts.
Audit Metadata