pitch-agent

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes financial data and business descriptions retrieved from external, potentially untrusted sources like SEC filings and web search results.
  • Ingestion points: Reads company business models and market positions from SEC 10-K/10-Q filings (SKILL.md, Step 2) and identifies recent transaction data through web searches (SKILL.md, Step 3).
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present to isolate the external data from the agent's core instructions.
  • Capability inventory: The agent has the capability to generate and save Excel (.xlsx) and PowerPoint (.pptx) files, and it uses Python for mathematical modeling and charting.
  • Sanitization: The skill does not describe any specific sanitization or validation mechanisms for the text data extracted from external filings.
  • [EXTERNAL_DOWNLOADS]: The skill references several external APIs and libraries to perform its financial analysis and document generation tasks.
  • APIs: Utilizes Tushare Pro (via MCP tools) for financial metrics, and exchangerate-api for currency conversion.
  • Python Packages: The instructions mention the use of yfinance for US stock data, python-pptx for presentation creation, and matplotlib or plotly for generating valuation charts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 05:58 AM