financial-data-analysis

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/data_fetcher.py utilizes the __import__ function within an environment check routine. Detailed inspection confirms this function iterates over a hardcoded dictionary of standard financial and data science libraries to verify their installation. It does not accept external input or dynamic paths from untrusted sources, making it a safe development practice for dependency validation.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to fetch financial market data from well-known services including the Tushare API and Yahoo Finance (via the yfinance library). These network requests target established financial data providers and are necessary for the skill's stated purpose of time series analysis.
  • [COMMAND_EXECUTION]: The agent is instructed to execute local Python scripts using the Bash tool to perform complex calculations and generate charts. These scripts (analysis_toolkit.py, indicators.py) rely on reputable open-source libraries like scipy, statsmodels, and pandas, and do not perform unauthorized system changes or privileged operations.
  • [INDIRECT_PROMPT_INJECTION]: As the skill ingests external financial data, it theoretically contains a surface for indirect prompt injection. However, the data typically consists of structured numerical price and volume information. The skill mitigates risks by enforcing strict output templates and requiring mandatory risk disclosures in all generated reports, ensuring the agent remains within analytical bounds.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 09:24 AM