skills/kouko/monkey-skills/data-us/Gen Agent Trust Hub

data-us

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The orchestrator script scripts/pack.py uses subprocess.run to execute localized client scripts (yfinance_client.py, sec_edgar_client.py, and fred_client.py). These calls are securely implemented using argument lists instead of shell execution, which effectively prevents command injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves data from several well-known and official external sources:
  • Official U.S. Securities and Exchange Commission (SEC) endpoints at data.sec.gov and www.sec.gov are used to fetch corporate filings and XBRL facts.
  • Federal Reserve Economic Data (FRED) endpoints at stlouisfed.org are used to retrieve macro-economic indicators.
  • Yahoo Finance is accessed via the yfinance library for market price and company information.
  • [SAFE]: The skill implements a robust local caching mechanism under ~/.cache/investing-toolkit/ to improve efficiency and reduce network load. This is a standard and benign developer practice for data-intensive tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 05:06 PM
Security Audit — agent-trust-hub — data-us