report-portfolio-review
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary function is to orchestrate other tools by executing shell commands via 'uv run'. This gives the agent a high degree of control over the local environment through script execution.
- [COMMAND_EXECUTION]: A significant risk of command injection exists in the pipeline described in SKILL.md. Ticker symbols extracted from a user-provided holdings file are interpolated into shell commands. If the ticker symbols contain shell metacharacters (e.g., semicolons or pipes), they could be used to execute arbitrary commands on the system.
- [DATA_EXFILTRATION]: The skill processes financial holdings and price data, writing intermediate JSON results to the /tmp directory. This practice may expose sensitive financial information in environments where the temporary directory is shared or persistent.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests external data (holdings file) and uses it to drive orchestration logic without explicit boundary markers or sanitization. 1. Ingestion points: holdings file (CSV/JSON); 2. Boundary markers: None; 3. Capability inventory: Subprocess/shell execution via uv run; 4. Sanitization: None identified in the orchestration instructions.
Audit Metadata