report-equity-memo
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Analysis of the orchestration logic and prompt templates revealed no malicious patterns or vulnerabilities. The skill structure is consistent with its stated purpose as a Layer 3 orchestrator.\n- [COMMAND_EXECUTION]: The skill utilizes
uv runto execute internal Python scripts from the plugin's own directory structure. Command arguments are derived from validated ticker patterns and specific country codes (us, jp, tw, kr, cn), which prevents arbitrary command injection.\n- [INDIRECT_PROMPT_INJECTION]: While the skill ingests external financial data (via Layer 1 skills) and user input (tickers, peers), it mitigates indirect injection risks. It follows a security-conscious 'paths-not-content' protocol, passing file references to the reporting agent instead of interpolating untrusted data directly into the prompt.\n- [DATA_EXFILTRATION]: No unauthorized data exposure or exfiltration patterns were detected. The skill uses a local temporary directory (/tmp/) for intermediate data storage, which is standard for local pipeline processing.
Audit Metadata