data-us
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator script
scripts/pack.pyusessubprocess.runto execute localized client scripts (yfinance_client.py,sec_edgar_client.py, andfred_client.py). These calls are securely implemented using argument lists instead of shell execution, which effectively prevents command injection risks. - [EXTERNAL_DOWNLOADS]: The skill retrieves data from several well-known and official external sources:
- Official U.S. Securities and Exchange Commission (SEC) endpoints at
data.sec.govandwww.sec.govare used to fetch corporate filings and XBRL facts. - Federal Reserve Economic Data (FRED) endpoints at
stlouisfed.orgare used to retrieve macro-economic indicators. - Yahoo Finance is accessed via the
yfinancelibrary for market price and company information. - [SAFE]: The skill implements a robust local caching mechanism under
~/.cache/investing-toolkit/to improve efficiency and reduce network load. This is a standard and benign developer practice for data-intensive tools.
Audit Metadata