financial-data-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/data_fetcher.pyutilizes the__import__function within an environment check routine. Detailed inspection confirms this function iterates over a hardcoded dictionary of standard financial and data science libraries to verify their installation. It does not accept external input or dynamic paths from untrusted sources, making it a safe development practice for dependency validation. - [EXTERNAL_DOWNLOADS]: The skill is designed to fetch financial market data from well-known services including the Tushare API and Yahoo Finance (via the
yfinancelibrary). These network requests target established financial data providers and are necessary for the skill's stated purpose of time series analysis. - [COMMAND_EXECUTION]: The agent is instructed to execute local Python scripts using the
Bashtool to perform complex calculations and generate charts. These scripts (analysis_toolkit.py,indicators.py) rely on reputable open-source libraries likescipy,statsmodels, andpandas, and do not perform unauthorized system changes or privileged operations. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests external financial data, it theoretically contains a surface for indirect prompt injection. However, the data typically consists of structured numerical price and volume information. The skill mitigates risks by enforcing strict output templates and requiring mandatory risk disclosures in all generated reports, ensuring the agent remains within analytical bounds.
Audit Metadata