valuation-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted GP valuation packages in various formats (PDF, Excel, CSV), creating a surface for indirect prompt injection where malicious instructions could be embedded in external financial documents.\n- Ingestion points: External fund accounting files (GP Packages) processed in Step 1 of the workflow.\n- Boundary markers: The skill explicitly defines GP data as untrustworthy and mandates processing within a sandbox isolation environment.\n- Capability inventory: Utilizes file parsing (OCR), financial data retrieval (Tushare, yfinance), and contract management (Notion) to perform calculations and reporting.\n- Sanitization: Implements independent verification against market data and requires manual sign-off from Investor Relations and Compliance before distribution.
Audit Metadata